restart splunkd remotely

[a212830]

Hi,

Is there a way (via Splunk cli?) to restart the splunkd process on remote servers?

[Leo · Accepted solution]

Using Splunk CLI:

splunk _internal call /services/server/control/restart -method POST -uri https://remoteserver:8089 -auth admin:goodpassword

Consider Web Terminal for Splunk app for situations when Splunk CLI or curl are not available.

[MartinMcNutt]

Powershell Winrm is turning out to be very nice add in my environment (Windows) for managing my servers. I am in the process of setting up 40+ and I used powershell with winrm to manage almost all settings.

When WINRM is up and configured you can use:

(Examples)

Powershell.exe

Invoke-Command -ComputerName $computername { <Command> }

or

Enter-pssession -computername
Cd Splunk\bin
.\splunk.exe restart
exit-pssession

WINRM with powershell is like telnet for unix. Microsoft finally understands the power of scripting and remote management via the command line.

[alacercogitatus]

curl -k -u admin:PASSWORD https://HOSTNAMEREMOTE:8089/services/server/control/restart -X POST

This should work as long as the PASSWORD is NOT the default (mainly for forwarders)