Unfortunately our installation of the AMQP Modular Messaging Input App stops running because of not enough memory every night. To workaround here, we set up a trigger, which should start a script that restarts the Splunk app. Is there a way to restart a splunk app via CLI?
try the following from SPLUNK_HOME/bin:
./splunk _internal call /services/apps/local/your_application_name/_reload -auth admin:$ADMINPWD
Hope it helps.
Why not address the root cause.
Add more memory , browse to the JVM Heap Size section in the docs : https://splunkbase.splunk.com/app/1812/#/documentation
Or consider scaling out your architecture because you are likely processing high volume ie: more AMQP modular inputs deployed over multiple Forwarders.See slides 20/21 : http://www.slideshare.net/damiendallimore/splunk-conf-2014-getting-the-message
I will test it. But I'm wondering if this is the cause. The app always stops working at midnight. Should rather stop after memory is full, shouldn't it?
I will observe it with some tools and produce a protocol.
Yeah, this is probably the obvious answer.
A similar question at https://answers.splunk.com/answers/2881/is-there-a-simple-way-to-reload-an-app.html.
try the following from SPLUNK_HOME/bin:
./splunk _internal call /services/apps/local/your_application_name/_reload -auth admin:$ADMINPWD
Hope it helps.
Thanks! The following worked for me:
splunk _internal call /apps/local/your_application_name/_reload
I'm running Splunk on Windows. The only difference now is the missing /services in the beginning. Splunk added it by itself. Don't know, if it has to do that splunk is running on Windows.
Hi yAlff, absolutely, you can execute the Splunk binary passing the restart paramater like:
$SPLUNK_HOME/bin/splunk restart #nix
"%PROGRAMFILES%\splunk\bin\splunk.exe" restart #windows batch
"$env:programfiles\splunk\bin\splunk.exe" restart #windows powershell
or the splunk controlling service
service splunk restart #nix pre systemd
systemctl restart splunk #nix systemd
restart-service *splunk* #powershell
Please let me know if this answers your question!
I downvoted this post because this is how to restart splunk. i want to restart an applikation installed in splunk, as it is written in the question.
A Splunk "application" (more appropriately, add-on) is really just an extension of Splunk. It can be thought of additional configuration. There isn't a method of "restarting" an app. You might some help by reloading that particular apps configuration as mentioned in another answer, but otherwise the you have a deeper problem with the modular input, that I expect only loads at Splunk startup.
you cannot restart an application without restarting Splunk....
@asimagu: why not?
Some app doesn't have that support, for example:
ERROR ApplicationUpdater - Error reloading Splunk_TA_stream: handler for server (http_post /replication/configuration/whitelist-reload): Configuration from app=Splunk_TA_stream does not support reload: server.conf/[diag]/EXCLUDE-key