Restart a splunk app via script

[yAlff]

Unfortunately our installation of the AMQP Modular Messaging Input App stops running because of not enough memory every night. To workaround here, we set up a trigger, which should start a script that restarts the Splunk app. Is there a way to restart a splunk app via CLI?

[Damien_Dallimor]

Why not address the root cause.

Add more memory , browse to the JVM Heap Size section in the docs : https://splunkbase.splunk.com/app/1812/#/documentation

Or consider scaling out your architecture because you are likely processing high volume ie: more AMQP modular inputs deployed over multiple Forwarders.See slides 20/21 : http://www.slideshare.net/damiendallimore/splunk-conf-2014-getting-the-message

[yAlff]

I will test it. But I'm wondering if this is the cause. The app always stops working at midnight. Should rather stop after memory is full, shouldn't it?
I will observe it with some tools and produce a protocol.

[muebel]

Yeah, this is probably the obvious answer.

[ddrillic]

A similar question at https://answers.splunk.com/answers/2881/is-there-a-simple-way-to-reload-an-app.html.

[fdi01 · Accepted solution]

try the following from SPLUNK_HOME/bin:

./splunk  _internal call /services/apps/local/your_application_name/_reload -auth admin:$ADMINPWD

Hope it helps.

[yAlff]

Thanks! The following worked for me:
splunk _internal call /apps/local/your_application_name/_reload

I'm running Splunk on Windows. The only difference now is the missing /services in the beginning. Splunk added it by itself. Don't know, if it has to do that splunk is running on Windows.

[muebel]

Hi yAlff, absolutely, you can execute the Splunk binary passing the restart paramater like:

$SPLUNK_HOME/bin/splunk restart #nix
"%PROGRAMFILES%\splunk\bin\splunk.exe" restart #windows batch
"$env:programfiles\splunk\bin\splunk.exe" restart #windows powershell

or the splunk controlling service

service splunk restart #nix pre systemd
systemctl restart splunk #nix systemd
restart-service *splunk* #powershell

Please let me know if this answers your question!

[yAlff]

I downvoted this post because this is how to restart splunk. i want to restart an applikation installed in splunk, as it is written in the question.

[muebel]

A Splunk "application" (more appropriately, add-on) is really just an extension of Splunk. It can be thought of additional configuration. There isn't a method of "restarting" an app. You might some help by reloading that particular apps configuration as mentioned in another answer, but otherwise the you have a deeper problem with the modular input, that I expect only loads at Splunk startup.

[asimagu]

you cannot restart an application without restarting Splunk....

[yAlff]

@asimagu: why not?

[tro]

Some app doesn't have that support, for example:

ERROR ApplicationUpdater - Error reloading Splunk_TA_stream: handler for server (http_post /replication/configuration/whitelist-reload): Configuration from app=Splunk_TA_stream does not support reload: server.conf/[diag]/EXCLUDE-key