Unfortunately our installation of the AMQP Modular Messaging Input App stops running because of not enough memory every night. To workaround here, we set up a trigger, which should start a script that restarts the Splunk app. Is there a way to restart a splunk app via CLI?
Why not address the root cause.
Add more memory , browse to the JVM Heap Size section in the docs : https://splunkbase.splunk.com/app/1812/#/documentation
Or consider scaling out your architecture because you are likely processing high volume ie: more AMQP modular inputs deployed over multiple Forwarders.See slides 20/21 : http://www.slideshare.net/damiendallimore/splunk-conf-2014-getting-the-message
I will test it. But I'm wondering if this is the cause. The app always stops working at midnight. Should rather stop after memory is full, shouldn't it?
I will observe it with some tools and produce a protocol.
Thanks! The following worked for me:
splunk _internal call /apps/local/your_application_name/_reload
I'm running Splunk on Windows. The only difference now is the missing /services in the beginning. Splunk added it by itself. Don't know, if it has to do that splunk is running on Windows.
Hi yAlff, absolutely, you can execute the Splunk binary passing the restart paramater like:
$SPLUNK_HOME/bin/splunk restart #nix "%PROGRAMFILES%\splunk\bin\splunk.exe" restart #windows batch "$env:programfiles\splunk\bin\splunk.exe" restart #windows powershell
or the splunk controlling service
service splunk restart #nix pre systemd systemctl restart splunk #nix systemd restart-service *splunk* #powershell
Please let me know if this answers your question!
A Splunk "application" (more appropriately, add-on) is really just an extension of Splunk. It can be thought of additional configuration. There isn't a method of "restarting" an app. You might some help by reloading that particular apps configuration as mentioned in another answer, but otherwise the you have a deeper problem with the modular input, that I expect only loads at Splunk startup.