Splunkd is running after ./splunk stop command

[marisstella]

Hii all,
I have created a copy of splunk instance, in the same server for testing purpose.. in this new splunk we will upgrade the version n check if the apps are working fine or not...
I copied some of the apps from old one to new splunk.. but here the issue is when i run ./splunk stop.. it only stopping SPLUNKWEB and SPLUNKD is running... But when i check it splunkweb is also running...
I don't whats happening...

Can as anybody tell me how to stop splunkd n splunkweb at a time??
Can you guys Guess my situation??

[sloshburch]

If you copied Splunk while it was running then it probably copied the splunk.pid files. Therefore, when you try to stop splunk from the new copied version, it will think the old version's processes are it's own and try to stop them. Furthermore, you should be experiencing port conflicts.

I highly recommend you do not do such testing on the same machine. It will require a lot of extra work to ensure no port collisions and avoid these quirks. Copy Splunk to a new VM. This can be done with Docker, VirtualBox, cloud providers, etc...

[sloshburch]

What is showing you Splunk is still running?

[nareshinsvu]

Did you try stopping splunk using absolute path ? like

/opt/blah/blah/Splunk/bin/splunk stop

Check out this blog if it helps

https://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine

[marisstella]

Yes, I tried that.... splunk is still running only splunkweb stopped..