https://community.splunk.com/t5/Monitoring-Splunk/What-does-quot-splunk-stop-quot-do/m-p/442424#M3711 <P>Don't <CODE>kill</CODE> Splunk. The <CODE>splunk stop</CODE> command tells Splunk to shut down gracefully. It waits for outstanding searches to complete before stopping. If you pull the rug out from under splunkd you risk corrupting your data in the event a lookup file is being written or a bucket is being updated.</P> Fri, 09 Aug 2019 21:50:07 GMT richgalloway 2019-08-09T21:50:07Z https://community.splunk.com/t5/Monitoring-Splunk/What-does-quot-splunk-stop-quot-do/m-p/442423#M3710 <P>My indexer takes a good 5+ minutes to stop, so I've been <CODE>pkill -f</CODE>'ing it for the last year and a half. What does <CODE>./splunk stop</CODE> do, how is a straight process kill different, and what am I risking?</P> Sat, 06 Jun 2020 01:29:27 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-does-quot-splunk-stop-quot-do/m-p/442423#M3710 nick405060 2020-06-06T01:29:27Z https://community.splunk.com/t5/Monitoring-Splunk/What-does-quot-splunk-stop-quot-do/m-p/442424#M3711 <P>Don't <CODE>kill</CODE> Splunk. The <CODE>splunk stop</CODE> command tells Splunk to shut down gracefully. It waits for outstanding searches to complete before stopping. If you pull the rug out from under splunkd you risk corrupting your data in the event a lookup file is being written or a bucket is being updated.</P> Fri, 09 Aug 2019 21:50:07 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-does-quot-splunk-stop-quot-do/m-p/442424#M3711 richgalloway 2019-08-09T21:50:07Z