All Apps and Add-ons

Splunk on Splunk: Using the PS tool, what are the start and restart commands shown by all my Splunk systems in the SOS index?


As I look in the SOS index i see all my 13 splunk systems showing a restart or start command to port 8089 like this;

splunkd -p_8089_restart

OR like this;

splunkd -p_8089_start

I have a suspicion that this is the command that that was given to start splunk so if I sent restart or start then that is what the process shows. Is that right?

Also I see some process commands like this;


Why do some start with the -h switch and some do not?


Splunkd is normally started by some invocation of $SPLUNK_HOME/bin/splunk, and I am thinking that you will see a start or restart option on the command in ps depending on how it was started. I am thinking that the -h parameter you are seeing is coming from an option in a stanza in a server.conf on one of your machines. I would look at server.conf(s) on the machine implicated by the value you see for -h or use btool on the system in question (which should also be the identified host value of an example event) to identify where this config item is coming from:

./splunk cmd btool server list --debug
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...