- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

That's Splunkweb's CherryPy webserver.
If that is a Search Head or otherwise an instance that needs the web UI then it's safe to restart that using $SPLUNK_HOME/bin/splunk restart splunkweb
- active users may experience a short interruption of service, but sessions and indexing and whatnot won't be affected.
If that's an Indexer, Heavy Forwarder, or any other instance that doesn't need the web UI then you can just turn it off in web.conf:
[settings]
startwebserver = 0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

That's Splunkweb's CherryPy webserver.
If that is a Search Head or otherwise an instance that needs the web UI then it's safe to restart that using $SPLUNK_HOME/bin/splunk restart splunkweb
- active users may experience a short interruption of service, but sessions and indexing and whatnot won't be affected.
If that's an Indexer, Heavy Forwarder, or any other instance that doesn't need the web UI then you can just turn it off in web.conf:
[settings]
startwebserver = 0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

@martin_mueller
The client name (/xyz/splunk/bin/splunk restart splunkweb) mentioned the answer is edited.
