Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Installation
- :
- Re: Splunkd is running after ./splunk stop command
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunkd is running after ./splunk stop command
Hii all,
I have created a copy of splunk instance, in the same server for testing purpose.. in this new splunk we will upgrade the version n check if the apps are working fine or not...
I copied some of the apps from old one to new splunk.. but here the issue is when i run ./splunk stop.. it only stopping SPLUNKWEB and SPLUNKD is running... But when i check it splunkweb is also running...
I don't whats happening...
Can as anybody tell me how to stop splunkd n splunkweb at a time??
Can you guys Guess my situation??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you copied Splunk while it was running then it probably copied the splunk.pid files. Therefore, when you try to stop splunk from the new copied version, it will think the old version's processes are it's own and try to stop them. Furthermore, you should be experiencing port conflicts.
I highly recommend you do not do such testing on the same machine. It will require a lot of extra work to ensure no port collisions and avoid these quirks. Copy Splunk to a new VM. This can be done with Docker, VirtualBox, cloud providers, etc...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is showing you Splunk is still running?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you try stopping splunk using absolute path ? like
/opt/blah/blah/Splunk/bin/splunk stop
Check out this blog if it helps
https://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I tried that.... splunk is still running only splunkweb stopped..
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster
What's New in Splunk Enterprise Security 8.8 and Beyond
A Four-Part Event Series: State of Observability - Where AI Meets Performance
