topic Re: Only one splunkd process? (windows) in Monitoring Splunk

Only one splunkd process? (windows)

srw46 — Tue, 13 Mar 2012 10:41:43 GMT

I read a while back that there should be two splunkd processes and one splunkweb. We configured our internal process monitors thusly.

They're alerting this morning because there is only one splunkd.exe. I did a restart, which fixed it temporarily but it's settled down to one splunkd again now.

Is this something to worry about? Has something changed regarding processes?

Re: Only one splunkd process? (windows)

MHibbin — Tue, 13 Mar 2012 11:12:35 GMT

srw46,

On Windows, there is only two processes running for Splunk... "Splunkd" and "Splunkweb".

On Linux, there are three processes running... two for splunkd and one for splunkweb (represented by python).

UPDATE: The following docs ... here ... mention that there are only two processes by default.

UPDATE: Just got the following output from two of my systems (one Win, one Linux)...

Windows:

C:\Program Files\Splunk\bin>splunk.exe status Splunkd: Running (pid 3300) Splunkweb: Running (pid 4092)

Linux:

/opt/splunk/bin # ./splunk status splunkd is running (PID: 7097). splunk helpers are running (PIDs: 7098 7148). splunkweb is running (PID: 7969).

Think this maybe where the confusion arose?

regards,

MHibbin

Re: Only one splunkd process? (windows)

srw46 — Wed, 14 Mar 2012 08:14:39 GMT

Many thanks, MHibbin.

Re: Only one splunkd process? (windows)

MHibbin — Wed, 14 Mar 2012 08:25:59 GMT

Hope this helps! 🙂