Is there a way in splunk 7.2.* to auto restart after crashing?

[sarit_s]

Hello

Is there a way in splunk 7.2.* to auto restart after crushing ?

i read this article :
https://docs.splunk.com/Documentation/Splunk/7.2.2/Admin/RunSplunkassystemdservice#Configure_systemd...
but for some reason i cant find any of this files in my system

Any suggestions?

[codebuilder · Accepted solution]

It depends on your version of Linux and whether it's using systemd.

For RHEL/Centos 7.x (systemd):
systemctl enable splunk

For RHEL/Centos 6.x and below (non-systemd):
chkconfig splunk on

Though deprecated, chkconfig will still work on systemd, but the opposite is not true.

[sarit_s]

i found the files.. just looked at the wrong place:)

looks like it is configured as expected but still im not sure splunk is recovered well after crushing

stopping splunk manually is a good way to check if its automatically restarts?
if yes then im sure it is not working 🙂

[codebuilder]

Both commands apply only to configuring Splunk to start after a reboot, not a crash.

[sarit_s]

oh, ok.
how can i auto start splunk after crush ?

[codebuilder]

It should come preconfigured to do so, but you can add Restart=always to the splunk unit file.

Example:

[Unit] Description=Systemd service
file for Splunk, generated by 'splunk
enable boot-start'
After=network.target

[Service] Type=simple Restart=always

Then reload the config:

systemctl daemon-reload

[sarit_s]

it is already conifgured
how can i validate it is working ?

[codebuilder]

Find the PID of your splunk daemon:

ps -ef |grep -i splunk

Then kill that process:

kill -9 pid_of_splunk_daemon

Wait a few seconds then re-run the ps command to verify it comes back up:

ps -ef |grep -i splunk

Note that if you really want to test this, it should be on a DEV or non-critical box.

[sarit_s]

thanks !
Splunk system is not production yet but just to be on the safe side - something bad can happen if i will kill the process ?

[codebuilder]

Nothing bad will happen, it is just not a graceful way to bring down a process. So I was adding my disclaimer, just in case 🙂

[sarit_s]

thank you very much !

[codebuilder]

Glad to help.