Is there a way to reload splunkd.pid and splunkweb.pid?

[_gkollias]

I ran in to this error as I was restarting a search head:

[splunk@serverName bin]$ ./splunk restart
splunkweb is not running.                                  [FAILED]
splunkd is not running.                                    [FAILED]

Splunk> Needle. Haystack. Found.

Checking prerequisites...
        Checking http port [xxxx]: already bound
ERROR: The http port [xxxx] is already bound.  Splunk needs to use this port.
Would you like to change ports? [y/n]:

I went in to /var/run/splunk and discovered that both pid files were non-existent. Is there a way to reload them so they are created, or is there a manual effort where I can create them? The only thing there are the pids generated for each.

Any insight would be greatly appreciated!

[Yasaswy · Accepted solution]

Hi,
I might have misunderstood the question, are you saying that your ports are "not" bound? If the ports are available, typically you can just restart splunk as you did above and it should create the pid files.

You can verify listening port by running netstat -anp|grep LIST
If the default ports (8000 and 8089) are bound (or ports you defined for splunk are bound). You may need to shut off the processes using those ports or run splunk on different ports.
You can reload process by killall -HUP pid

[_gkollias]

The netstat command is perfect. Exactly what was needed to kill the orphan process. Thanks!