Issue with splunk stop/restart command in CentOS 7.2

[keerthana_k]

Hi All,

Our distributed splunk setup contains a deployment server, an indexer cluster master, 3 peer indexers and 2 search heads. We use CentOS 7.2 for all our splunk instances and use salt stack to manage the nodes from a single point.

In our salt script, we use the command: service splunk stop/restart while installing or upgrading our apps. However, we find that this command works inconsistently. The command /opt/splunk/bin/splunk stop/restart works correctly.

Has anybody else faced this issue? Is this an issue specific to CentOS? Any pointers to this will be really helpful.

Thanks,
Keerthana

[jonmargulies]

The only potential issue I can think of is that "service splunk ..." requires elevated privileges while "/opt/splunk/bin/splunk ..." requires the privileges of whichever user owns /opt/splunk and its files. That's where I'd investigate first.