Splunk Enterprise

Does 6.5 launch more pids?



I noticed today that there seems to be a lot more pids running by Splunk in 6.5. Is this by design? Below is an example - I don't recall seeing these "launcher" pids before.

splunk 1971 1 99 21:23 ? 00:10:19 splunkd -p 8089 restart
splunk 1978 1971 0 21:23 ? 00:00:00 [splunkd pid=1971] splunkd -p 8089 restart [process-runner]
splunk 5953 1978 0 21:30 ? 00:00:01 [splunkd pid=1971] [search-launcher]
splunk 5954 5953 0 21:30 ? 00:00:00 [splunkd pid=1971] [search-launcher] [process-runner]
splunk 5956 1978 0 21:30 ? 00:00:01 [splunkd pid=1971] [search-launcher]
splunk 5964 5956 0 21:30 ? 00:00:00 [splunkd pid=1971] [search-launcher] [process-runner]

Tags (2)
0 Karma


Are these the "pre-launched" search processes?

0 Karma

Splunk Employee
Splunk Employee

You seeing this on SH, Indexer, Utility, everything?

Honestly that seems fishy that they are the same. Did they clear after restart or are they persisting?

Compared to my DS, I only see relevant looking pids.

I'd suggest stopping splunk and seeing is there's any remaining pids. If so, kill those zombies (head shot FTW) and then start splunk and I'm guessing you're good. Sometimes unix processes just live on so I've seen that quirk before.

0 Karma

Splunk Employee
Splunk Employee

This looks OK to me. The [splunkd pid=1971] shows that those processes tie back to the main splunkd launch process. The PID chain looks accurate.
5954 and 5964 may be the two default DMA (data model acceleration) search processes that were introduced in 6.5, but I am not 100% certain.

0 Karma


Hey Burch!

I see it on all my components - idx, sh... anything that runs a search.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...