Monitoring Splunk

difference between splunkd and Splunkd service on Indexer

Path Finder

We noticed we have 2 different processes running:

systemctl status splunk
systemctl status Splunkd

The docs explain that there are 2 ways to setup the Splunk service

Is it correct that the 2 are running in parallel on the same machine? should it not be either one or the other?

Labels (1)
0 Karma


This tells me that you have two Splunk process running under different users.
The daemon name is configured withing /opt/splunk/etc/splunk-launch.conf

You likely have one running from init.d (default) and another from systemd after configuring it.

Assuming this is not production, I would suggest that you try the following, in order:

/opt/splunk/bin/splunk stop
systemctl stop Splunkd
(here is where you can modify the daemon name in /opt/splunk/etc/splunk-launch.conf)
systemctl start Splunkd (or the name you set within the conf file)
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...