Monitoring Splunk

Is there a way to reload splunkd.pid and splunkweb.pid?

_gkollias
SplunkTrust
SplunkTrust

I ran in to this error as I was restarting a search head:

[splunk@serverName bin]$ ./splunk restart
splunkweb is not running.                                  [FAILED]
splunkd is not running.                                    [FAILED]

Splunk> Needle. Haystack. Found.

Checking prerequisites...
        Checking http port [xxxx]: already bound
ERROR: The http port [xxxx] is already bound.  Splunk needs to use this port.
Would you like to change ports? [y/n]:

I went in to /var/run/splunk and discovered that both pid files were non-existent. Is there a way to reload them so they are created, or is there a manual effort where I can create them? The only thing there are the pids generated for each.

Any insight would be greatly appreciated!

Tags (2)
0 Karma
1 Solution

Yasaswy
Contributor

Hi,
I might have misunderstood the question, are you saying that your ports are "not" bound? If the ports are available, typically you can just restart splunk as you did above and it should create the pid files.

You can verify listening port by running netstat -anp|grep LIST
If the default ports (8000 and 8089) are bound (or ports you defined for splunk are bound). You may need to shut off the processes using those ports or run splunk on different ports.
You can reload process by killall -HUP pid

View solution in original post

Yasaswy
Contributor

Hi,
I might have misunderstood the question, are you saying that your ports are "not" bound? If the ports are available, typically you can just restart splunk as you did above and it should create the pid files.

You can verify listening port by running netstat -anp|grep LIST
If the default ports (8000 and 8089) are bound (or ports you defined for splunk are bound). You may need to shut off the processes using those ports or run splunk on different ports.
You can reload process by killall -HUP pid

_gkollias
SplunkTrust
SplunkTrust

The netstat command is perfect. Exactly what was needed to kill the orphan process. Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...