difference between splunkd and Splunkd service on Indexer

wfskmoney — Sat, 06 Jun 2020 00:18:59 GMT

We noticed we have 2 different processes running:

systemctl status splunk
systemctl status Splunkd

The docs explain that there are 2 ways to setup the Splunk service
https://docs.splunk.com/Documentation/Splunk/latest/Admin/RunSplunkassystemdservice#Unit_file_naming_considerations

Is it correct that the 2 are running in parallel on the same machine? should it not be either one or the other?

Re: difference between splunkd and Splunkd service on Indexer

codebuilder — Fri, 13 Dec 2019 21:41:59 GMT

This tells me that you have two Splunk process running under different users.
The daemon name is configured withing /opt/splunk/etc/splunk-launch.conf

You likely have one running from init.d (default) and another from systemd after configuring it.

Assuming this is not production, I would suggest that you try the following, in order:

/opt/splunk/bin/splunk stop
systemctl stop Splunkd
(here is where you can modify the daemon name in /opt/splunk/etc/splunk-launch.conf)
systemctl start Splunkd (or the name you set within the conf file)

topic difference between splunkd and Splunkd service on Indexer in Monitoring Splunk

difference between splunkd and Splunkd service on Indexer

Re: difference between splunkd and Splunkd service on Indexer