I know this sounds bad: disable all unneeded services except Splunk and reboot. ... View more

So, it turns out you can launch splunkd via "splunk start" in a non-exiting mode using the --nodaemon parameter: ./splunk start splunkd --nodaemon This might make it a lot easier. It's unfortunately not actually in the official docs or the help, but it works. The PID you care about really will just be the splunk start wrapper, so it kind of doesn't entirely do it to just look for that PID. Worse, if the splunkd process ends or fails, the wrapper doesn't exit, which is kind of fail. I guess with this, you can chose one problem or another. ... View more