Only one splunkd process? (windows)

[srw46]

I read a while back that there should be two splunkd processes and one splunkweb. We configured our internal process monitors thusly.

They're alerting this morning because there is only one splunkd.exe. I did a restart, which fixed it temporarily but it's settled down to one splunkd again now.

Is this something to worry about? Has something changed regarding processes?

[srw46]

Many thanks, MHibbin.

[MHibbin]

Hope this helps! 🙂

[MHibbin · Accepted solution]

srw46,

On Windows, there is only two processes running for Splunk... "Splunkd" and "Splunkweb".

On Linux, there are three processes running... two for splunkd and one for splunkweb (represented by python).

UPDATE: The following docs ... here ... mention that there are only two processes by default.

UPDATE: Just got the following output from two of my systems (one Win, one Linux)...

Windows:

C:\Program Files\Splunk\bin>splunk.exe status
Splunkd: Running (pid 3300)
Splunkweb: Running (pid 4092)

Linux:

/opt/splunk/bin # ./splunk status
splunkd is running (PID: 7097).
splunk helpers are running (PIDs: 7098 7148).
splunkweb is running (PID: 7969).

Think this maybe where the confusion arose?

regards,

MHibbin