Deployment Architecture

Is there a way in splunk 7.2.* to auto restart after crashing?

sarit_s
Communicator

Hello

Is there a way in splunk 7.2.* to auto restart after crushing ?

i read this article :
https://docs.splunk.com/Documentation/Splunk/7.2.2/Admin/RunSplunkassystemdservice#Configure_systemd...
but for some reason i cant find any of this files in my system

Any suggestions?

0 Karma
1 Solution

codebuilder
SplunkTrust
SplunkTrust

It depends on your version of Linux and whether it's using systemd.

For RHEL/Centos 7.x (systemd):
systemctl enable splunk

For RHEL/Centos 6.x and below (non-systemd):
chkconfig splunk on

Though deprecated, chkconfig will still work on systemd, but the opposite is not true.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
SplunkTrust
SplunkTrust

It depends on your version of Linux and whether it's using systemd.

For RHEL/Centos 7.x (systemd):
systemctl enable splunk

For RHEL/Centos 6.x and below (non-systemd):
chkconfig splunk on

Though deprecated, chkconfig will still work on systemd, but the opposite is not true.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

sarit_s
Communicator

i found the files.. just looked at the wrong place:)

looks like it is configured as expected but still im not sure splunk is recovered well after crushing

stopping splunk manually is a good way to check if its automatically restarts?
if yes then im sure it is not working 🙂

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Both commands apply only to configuring Splunk to start after a reboot, not a crash.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

sarit_s
Communicator

oh, ok.
how can i auto start splunk after crush ?

0 Karma

codebuilder
SplunkTrust
SplunkTrust

It should come preconfigured to do so, but you can add Restart=always to the splunk unit file.

Example:

[Unit] Description=Systemd service
file for Splunk, generated by 'splunk
enable boot-start'
After=network.target

[Service] Type=simple Restart=always

Then reload the config:

systemctl daemon-reload

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

sarit_s
Communicator

it is already conifgured
how can i validate it is working ?

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Find the PID of your splunk daemon:

ps -ef |grep -i splunk

Then kill that process:

kill -9 pid_of_splunk_daemon

Wait a few seconds then re-run the ps command to verify it comes back up:

ps -ef |grep -i splunk

Note that if you really want to test this, it should be on a DEV or non-critical box.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

sarit_s
Communicator

thanks !
Splunk system is not production yet but just to be on the safe side - something bad can happen if i will kill the process ?

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Nothing bad will happen, it is just not a graceful way to bring down a process. So I was adding my disclaimer, just in case 🙂

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

sarit_s
Communicator

thank you very much !

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Glad to help.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...