My indexer takes a good 5+ minutes to stop, so I've been pkill -f
'ing it for the last year and a half. What does ./splunk stop
do, how is a straight process kill different, and what am I risking?
Don't kill
Splunk. The splunk stop
command tells Splunk to shut down gracefully. It waits for outstanding searches to complete before stopping. If you pull the rug out from under splunkd you risk corrupting your data in the event a lookup file is being written or a bucket is being updated.