Monitoring Splunk

Only one splunkd process? (windows)

srw46
Path Finder

I read a while back that there should be two splunkd processes and one splunkweb. We configured our internal process monitors thusly.

They're alerting this morning because there is only one splunkd.exe. I did a restart, which fixed it temporarily but it's settled down to one splunkd again now.

Is this something to worry about? Has something changed regarding processes?

Tags (1)
0 Karma
1 Solution

MHibbin
Influencer

srw46,

On Windows, there is only two processes running for Splunk... "Splunkd" and "Splunkweb".

On Linux, there are three processes running... two for splunkd and one for splunkweb (represented by python).

UPDATE: The following docs ... here ... mention that there are only two processes by default.

UPDATE: Just got the following output from two of my systems (one Win, one Linux)...

Windows:

C:\Program Files\Splunk\bin>splunk.exe status
Splunkd: Running (pid 3300)
Splunkweb: Running (pid 4092)

Linux:

/opt/splunk/bin # ./splunk status
splunkd is running (PID: 7097).
splunk helpers are running (PIDs: 7098 7148).
splunkweb is running (PID: 7969).

Think this maybe where the confusion arose?

regards,

MHibbin

View solution in original post

srw46
Path Finder

Many thanks, MHibbin.

0 Karma

MHibbin
Influencer

Hope this helps! 🙂

0 Karma

MHibbin
Influencer

srw46,

On Windows, there is only two processes running for Splunk... "Splunkd" and "Splunkweb".

On Linux, there are three processes running... two for splunkd and one for splunkweb (represented by python).

UPDATE: The following docs ... here ... mention that there are only two processes by default.

UPDATE: Just got the following output from two of my systems (one Win, one Linux)...

Windows:

C:\Program Files\Splunk\bin>splunk.exe status
Splunkd: Running (pid 3300)
Splunkweb: Running (pid 4092)

Linux:

/opt/splunk/bin # ./splunk status
splunkd is running (PID: 7097).
splunk helpers are running (PIDs: 7098 7148).
splunkweb is running (PID: 7969).

Think this maybe where the confusion arose?

regards,

MHibbin

Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...