splunk is starting after stopping

[yazdanhasainar]

splunk is Re starting after stopping,

I have tried killing the process too. But no help.

Running process:

ps -eaf | grep splunk

splunk 21469 1 3 12:51 ? 00:00:02 splunkd -p 8089 start
splunk 21473 21469 0 12:51 ? 00:00:00 [splunkd pid=21469] splunkd -p 8089 start [process-runner]
splunk 21485 21473 0 12:51 ? 00:00:00 mongod --dbpath=/opt/data/kvstore/mongo --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize=200 --keyFile=/opt/data/kvstore/mongo/splunk.key --setParameter=enableLocalhostAuthBypass=0 --replSet=601B05C0-55BD-4990-BDFE-FE2DA91D04D7 --sslAllowInvalidHostnames --sslMode=preferSSL --sslPEMKeyFile=/opt/splunk/etc/auth/server.pem --sslPEMKeyPassword=xxxxxxxx --nounixsocket
splunk 21589 21473 1 12:51 ? 00:00:00 /opt/splunk/bin/python -O /opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
splunk 21639 21473 0 12:51 ? 00:00:00 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore

i cant even disable boot-start :

-> sudo /opt/splunk/bin/splunk disable boot-start -user splunk
error reading information on service splunk: No such file or directory

Can someone help me in stopping Splunk?

[woodcock · Accepted solution]

If you have setup splunk as a service then it will start itself automatically. Try this instead:

service splunk stop

[yazdanhasainar]

It worked, Thanks

[gcusello]

Hi yazdanhasainar,
your splunk runs using root or splunk user?
probably there's a problem in grants.

Bye.
Giuseppe

[yazdanhasainar]

Splunk is running using splunk user only, but the service was in root. logged in as root and stopped service : service splunk stop

[yazdanhasainar]

[splunk@ip-10-0-101-225 local]$ /opt/splunk/bin/splunk stop
Stopping splunkd...
Shutting down. Please wait, as this may take a few minutes.
... [ OK ]
Stopping splunk helpers...
[ OK ]
Done.
[splunk@ip-10-0-101-225 local]$ /opt/splunk/bin/splunk status
splunkd is running (PID: 23191).
splunk helpers are running (PIDs: 23192 23203 23306 23356).
[splunk@ip-10-0-101-225 local]$