Splunk Search

Multiple instances of Splunk w/ Boot-start

magicfletch
Engager

How can I have multiple splunk instances on linux and use boot-start? The command "./splunk enable boot-start" will over-write the previous startup script in /etc/init.d

Tags (1)
1 Solution

cgilbert_splunk
Splunk Employee
Splunk Employee

You could run the './splunk enable boot-start' command on the first instance of splunk, then just rename your /etc/init.d script to something like "splunk1" or "splunk2" or something like that, then run chkconfig -add (e.g. chkconfig -add splunk1...that will create all the symbolic links in the rcx.d folders and perform all the other magic. Then, you can move to the next instance and run ./splunk enable boot-start on this instance and rename it again...etc. Basically, every instance will edit/overwrite the script /etc/init.d/splunk...so plan accordingly.

You could also edit the /etc/init.d/splunk script, I suppose...but that seems more error-prone.

View solution in original post

cgilbert_splunk
Splunk Employee
Splunk Employee

You could run the './splunk enable boot-start' command on the first instance of splunk, then just rename your /etc/init.d script to something like "splunk1" or "splunk2" or something like that, then run chkconfig -add (e.g. chkconfig -add splunk1...that will create all the symbolic links in the rcx.d folders and perform all the other magic. Then, you can move to the next instance and run ./splunk enable boot-start on this instance and rename it again...etc. Basically, every instance will edit/overwrite the script /etc/init.d/splunk...so plan accordingly.

You could also edit the /etc/init.d/splunk script, I suppose...but that seems more error-prone.

Stefan
Explorer

Careful with the syntax here as chkconfig expects --add

chkcnfig --add

It's interesting to note that by using

chkconfig --list

you may check that you've gotten all the scripts you need configured as planned.

0 Karma

vbumgarner
Contributor

There is a pid file mentioned in the script that should be modified in the second script, no?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...