What does "./splunk stop" do?

[nick405060]

My indexer takes a good 5+ minutes to stop, so I've been pkill -f'ing it for the last year and a half. What does ./splunk stop do, how is a straight process kill different, and what am I risking?

[richgalloway]

Don't kill Splunk. The splunk stop command tells Splunk to shut down gracefully. It waits for outstanding searches to complete before stopping. If you pull the rug out from under splunkd you risk corrupting your data in the event a lookup file is being written or a bucket is being updated.