Why couldn't I send SIGTERM to pid 5632: Operation not permitted?

[adityapavan18]

I am getting following error while i am trying to start the splunk forwarder process.
Can anyone please help me??

[koshyk]

Agree, the answer is removing .pid file, but for easy copy and paste on Linux machines
ensure you are "splunk" user

SPLUNK_HOME="/opt/splunk"
rm $SPLUNK_HOME/var/run/splunk/splunkd.pid
$SPLUNK_HOME/bin/splunk status
$SPLUNK_HOME/bin/splunk start

[edavson]

pretty much what adityapavan18 said above but...

i moved the file '//var/run/splunk/splunkd.pid' to '//var/run/splunk/splunkd.pid.old' then ran '//bin/splunk start'. I guess you can delete the .old file after that.

the new splunkd.pid is created after start is complete

[DataOrg]

we can remove or we can rename or we can move to other location the splunk.pid file.
while starting splunkd it will check for the old splunk.pid file if its not there it will create new one and splunkd will be started

[adityapavan18 · Accepted solution]

Thanks seems to have resolved it after i deleted the splunk.pid file from var/run folder inside splunk.

[ssuluguri]

Thanks for the update , Even I undergone the same issue , after performing suggested steps , splunk started

[koshyk]

for easier copy paste 🙂

rm $SPLUNK_HOME/var/run/splunk/splunkd.pid
$SPLUNK_HOME/bin/splunk status
$SPLUNK_HOME/bin/splunk start

[N92]

What's the reason for this? We are facing issue multiple time.