Splunk Search

Multiple instances of Splunk w/ Boot-start

magicfletch
Engager

How can I have multiple splunk instances on linux and use boot-start? The command "./splunk enable boot-start" will over-write the previous startup script in /etc/init.d

Tags (1)
1 Solution

cgilbert_splunk
Splunk Employee
Splunk Employee

You could run the './splunk enable boot-start' command on the first instance of splunk, then just rename your /etc/init.d script to something like "splunk1" or "splunk2" or something like that, then run chkconfig -add (e.g. chkconfig -add splunk1...that will create all the symbolic links in the rcx.d folders and perform all the other magic. Then, you can move to the next instance and run ./splunk enable boot-start on this instance and rename it again...etc. Basically, every instance will edit/overwrite the script /etc/init.d/splunk...so plan accordingly.

You could also edit the /etc/init.d/splunk script, I suppose...but that seems more error-prone.

View solution in original post

cgilbert_splunk
Splunk Employee
Splunk Employee

You could run the './splunk enable boot-start' command on the first instance of splunk, then just rename your /etc/init.d script to something like "splunk1" or "splunk2" or something like that, then run chkconfig -add (e.g. chkconfig -add splunk1...that will create all the symbolic links in the rcx.d folders and perform all the other magic. Then, you can move to the next instance and run ./splunk enable boot-start on this instance and rename it again...etc. Basically, every instance will edit/overwrite the script /etc/init.d/splunk...so plan accordingly.

You could also edit the /etc/init.d/splunk script, I suppose...but that seems more error-prone.

Stefan
Explorer

Careful with the syntax here as chkconfig expects --add

chkcnfig --add

It's interesting to note that by using

chkconfig --list

you may check that you've gotten all the scripts you need configured as planned.

0 Karma

vbumgarner
Contributor

There is a pid file mentioned in the script that should be modified in the second script, no?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...