Hi there, after investigation my Search Head instance I found this in my task bar.
Can somebody say is it expected behaviour?
It's normal to see "splunkd -p 8089 restart" in the process list because that is the command that launched Splunk. I'm not sure, however, about why it appears so many times. AIUI, there should be a single "splunkd -p 8089 restart" process and additional "splunkd" processes for running searches. I could be mistaken, however.
This seems to be some fancy modern top-like program. And I supose it shows separate threads of single splunkd process. Notice that the memory usage is identical for all those entries.
Hi @Haleb
*Yes* - This is to be expected, this is based on how the Splunk instance was started.
Essentially if Splunk started by "$SPLUNK_HOME/bin/splunk start" it will appended with "start", if it was "$SPLUNK_HOME/bin/splunk restart" it will be appended with "restart". If you use systemd then it could be something like "splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd"
Check out the following Community post with a little more info if interested: https://community.splunk.com/t5/Monitoring-Splunk/Difference-between-splunkd-p-8089-restart-or-splun...
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing