All Apps and Add-ons

Restart a splunk app via script

yAlff
Path Finder

Unfortunately our installation of the AMQP Modular Messaging Input App stops running because of not enough memory every night. To workaround here, we set up a trigger, which should start a script that restarts the Splunk app. Is there a way to restart a splunk app via CLI?

Labels (1)
0 Karma
1 Solution

fdi01
Motivator

try the following from SPLUNK_HOME/bin:

./splunk  _internal call /services/apps/local/your_application_name/_reload -auth admin:$ADMINPWD

Hope it helps.

View solution in original post

Tags (1)

Damien_Dallimor
Ultra Champion

Why not address the root cause.

Add more memory , browse to the JVM Heap Size section in the docs : https://splunkbase.splunk.com/app/1812/#/documentation

Or consider scaling out your architecture because you are likely processing high volume ie: more AMQP modular inputs deployed over multiple Forwarders.See slides 20/21 : http://www.slideshare.net/damiendallimore/splunk-conf-2014-getting-the-message

yAlff
Path Finder

I will test it. But I'm wondering if this is the cause. The app always stops working at midnight. Should rather stop after memory is full, shouldn't it?
I will observe it with some tools and produce a protocol.

0 Karma

muebel
SplunkTrust
SplunkTrust

Yeah, this is probably the obvious answer.

0 Karma

ddrillic
Ultra Champion
0 Karma

fdi01
Motivator

try the following from SPLUNK_HOME/bin:

./splunk  _internal call /services/apps/local/your_application_name/_reload -auth admin:$ADMINPWD

Hope it helps.

Tags (1)

yAlff
Path Finder

Thanks! The following worked for me:
splunk _internal call /apps/local/your_application_name/_reload

I'm running Splunk on Windows. The only difference now is the missing /services in the beginning. Splunk added it by itself. Don't know, if it has to do that splunk is running on Windows.

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi yAlff, absolutely, you can execute the Splunk binary passing the restart paramater like:

$SPLUNK_HOME/bin/splunk restart #nix
"%PROGRAMFILES%\splunk\bin\splunk.exe" restart #windows batch
"$env:programfiles\splunk\bin\splunk.exe" restart #windows powershell

or the splunk controlling service

service splunk restart #nix pre systemd
systemctl restart splunk #nix systemd
restart-service *splunk* #powershell

Please let me know if this answers your question!

0 Karma

yAlff
Path Finder

I downvoted this post because this is how to restart splunk. i want to restart an applikation installed in splunk, as it is written in the question.

0 Karma

muebel
SplunkTrust
SplunkTrust

A Splunk "application" (more appropriately, add-on) is really just an extension of Splunk. It can be thought of additional configuration. There isn't a method of "restarting" an app. You might some help by reloading that particular apps configuration as mentioned in another answer, but otherwise the you have a deeper problem with the modular input, that I expect only loads at Splunk startup.

0 Karma

asimagu
Builder

you cannot restart an application without restarting Splunk....

0 Karma

yAlff
Path Finder

@asimagu: why not?

0 Karma

tro
Path Finder

Some app doesn't have that support, for example:

ERROR ApplicationUpdater - Error reloading Splunk_TA_stream: handler for server (http_post /replication/configuration/whitelist-reload): Configuration from app=Splunk_TA_stream does not support reload: server.conf/[diag]/EXCLUDE-key

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...