Deployment Architecture

Sanity Check After Restarting Splunk And Having Trouble

jpass
Contributor

I have Splunk 4.32 installed on Linux. Today I stopped Splunk, used the 'clean eventdata index_name' to clear up some disk space by removing test_index data.

I then restarted Splunk and in the start-up process it said "splunkweb is already running". But at this time I was not able to access Splunk web. Splunkd had started.

I then stopped splunk again and started Splunk once again. Same thing, splunk web is already runnning but I can't access it.

After I stopping splunk again and then restarting it I got the same message. This time I use the command 'restart splunkweb' and now splunk is back up and everything seems to be working fine. But I'm wondering if the follow out put of "top -c -u splunk" is normal. Specifically the follow line:

**/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py start**

output from 'top -c -u splunk
3906 splunk    20   0  507m 364m  12m S    0  4.5   7:14.31 splunkd -p 8089 start
3907 splunk    20   0 55284 9760  956 S    0  0.1   0:00.17 splunkd -p 8089 start
3989 splunk    20   0  3956  604  512 S    0  0.0   0:00.00 /bin/sh -c python /<splunk_home>/etc/apps/dbx/bin/jbridge_server.py
3990 splunk    20   0  135m  13m 4284 S    0  0.2   0:00.14 python /<splunk_home>/etc/apps/dbx/bin/jbridge_server.py 
3992 splunk    20   0  522m  73m 9940 S    0  0.9   0:03.31 /usr/lib/jvm/java-6-sun-1.6.0.26/bin/java -cp /<splunk_home>/etc/apps/dbx/bin/lib/jdbm-2.2.jar:/<splunk_home>/etc/apps/dbx/bin/lib/commons-pool-1.5.6.ja
4350 splunk    20   0  379m  72m 5820 S    0  0.9   0:10.36 python -O /<splunk_home>/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py start

Thanks

0 Karma

grijhwani
Motivator

More telling would be a "ps -ef | grep py". It is possible that you had some rogue processes still present.

grijhwani
Motivator

Nothing obviously untoward there, but now that it has restarted successfully there is not much to tell you what was going on.

If it happens again, try the ps command before another restart attempt.

0 Karma

jpass
Contributor

thanks grijhwani. I was out of town a few days which is why I didn't respond for a while. I see this:

618 5788 5753 0 20:44 pts/1 00:00:00 grep --color=auto py
splunk 14032 1 0 Oct20 ? 01:51:11 python -O splunk_home/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py restart
splunk 14082 13956 0 Oct20 ? 00:00:00 /bin/sh -c python splunk_home/etc/apps/dbx/bin/jbridge_server.py
splunk 14083 14082 0 Oct20 ? 00:00:23 python splunk_home/etc/apps/dbx/bin/jbridge_server.py

What do you think?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...