splunk processes

[a212830]

Hi,

I want to add some monitoring to check that required splunk processes are running. On the indexer, I see the following:

plunk 7481 1 9 Nov26 ? 1-10:34:49 splunkd -p 8089 start
splunk 7482 7481 0 Nov26 ? 00:13:37 [splunkd pid=7481] splunkd -p 8089 start [process-runner]
splunk 7639 1 0 Nov26 ? 00:59:43 python -O /apps/splunk/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py start

Which of these are required to be running? I'm assuming pid 7481 - are the others required? Or do they spawn as needed?

[yannK]

The first splunk process looks like the main one.

You can take a look at the sos app (ta-sos) they have a script to monitor the splunk processes (ps-sos.sh for linux or ps-sos.ps1 for win)
Then check the sos ressource dashboard, you will see the method used in the searches to distinguish the processes :

• splunkd battleship
• splunkweb
• splunk searches