Splunk Search

Multiple instances of Splunk w/ Boot-start

magicfletch
Engager

How can I have multiple splunk instances on linux and use boot-start? The command "./splunk enable boot-start" will over-write the previous startup script in /etc/init.d

Tags (1)
1 Solution

cgilbert_splunk
Splunk Employee
Splunk Employee

You could run the './splunk enable boot-start' command on the first instance of splunk, then just rename your /etc/init.d script to something like "splunk1" or "splunk2" or something like that, then run chkconfig -add (e.g. chkconfig -add splunk1...that will create all the symbolic links in the rcx.d folders and perform all the other magic. Then, you can move to the next instance and run ./splunk enable boot-start on this instance and rename it again...etc. Basically, every instance will edit/overwrite the script /etc/init.d/splunk...so plan accordingly.

You could also edit the /etc/init.d/splunk script, I suppose...but that seems more error-prone.

View solution in original post

cgilbert_splunk
Splunk Employee
Splunk Employee

You could run the './splunk enable boot-start' command on the first instance of splunk, then just rename your /etc/init.d script to something like "splunk1" or "splunk2" or something like that, then run chkconfig -add (e.g. chkconfig -add splunk1...that will create all the symbolic links in the rcx.d folders and perform all the other magic. Then, you can move to the next instance and run ./splunk enable boot-start on this instance and rename it again...etc. Basically, every instance will edit/overwrite the script /etc/init.d/splunk...so plan accordingly.

You could also edit the /etc/init.d/splunk script, I suppose...but that seems more error-prone.

Stefan
Explorer

Careful with the syntax here as chkconfig expects --add

chkcnfig --add

It's interesting to note that by using

chkconfig --list

you may check that you've gotten all the scripts you need configured as planned.

0 Karma

vbumgarner
Contributor

There is a pid file mentioned in the script that should be modified in the second script, no?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...