Getting Data In

restarting splunk from script input

Engager

trying to restart splunk via a script... everything in the script works fine but when the restart happens the script dies at that point too. how to have splunk start the script on startup and when it does the restart, keep the script running and let it complete on its own (windows and linux)?

Labels (2)
0 Karma

Path Finder

Hi @Cstone1,

So if I'm reading this right, you are "restarting" splunk after you upgrade it?

If so, that is where the script is breaking. After you upgrade a Splunk Instance, you need to accept the End User License Agreement again before it will even start.
Splunk cannot "restart" an instance that hasn't made it past the End User License Agreement step.

You can accept the license but instead of "splunk restart" you should use the following command depending on your splunk instance:

Splunk Enterprise:
"/opt/splunk/bin/splunk start --accept-license"
- OR-
Splunk Universal Forwarder:
"/opt/splunkforwarder/bin/splunk start --accept-license"

Let us know if this fixes your script!

V/R,
nwuest

0 Karma

Engager

hi thx for the reply but, no not quite.

In windows the MSI will install while splunk is running and restart it after its done. But in linux its a TGZ extract (not locking it to a specific distro using rpms or debs etc). 

Extracting it while running causes a lot of errors and sometimes succeeds but not reliable.

 

So a very highlevel sequence is this

 

1. do all checks

2. stop splunk

3. create backup

script dies when splunk stops so a partial backup is made. 

4. untar new

5. restart with accept lic and answer yes

ill add, that when i run it manually it works fine.

0 Karma

Path Finder

Hi @Cstone1,

Are you wanting to have a splunk "instance", kick-off a script (via an app) that does a restart (of the splunk service I'm guessing) that of which keeps the script running after the restart portion?

Might I ask as to what you are trying to accomplish before and after you are wanting the splunk service to restart?

I look forward to hearing from you

V/R,
nwuest

 

0 Karma

Engager

cuz I'd like to shut it down, back it up, upgrade it and restart it.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!