Monitoring Splunk

What does "./splunk stop" do?


My indexer takes a good 5+ minutes to stop, so I've been pkill -f'ing it for the last year and a half. What does ./splunk stop do, how is a straight process kill different, and what am I risking?

Labels (1)
0 Karma


Don't kill Splunk. The splunk stop command tells Splunk to shut down gracefully. It waits for outstanding searches to complete before stopping. If you pull the rug out from under splunkd you risk corrupting your data in the event a lookup file is being written or a bucket is being updated.

If this reply helps you, an upvote would be appreciated.
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.