Monitoring Splunk

Only one splunkd process? (windows)

srw46
Path Finder

I read a while back that there should be two splunkd processes and one splunkweb. We configured our internal process monitors thusly.

They're alerting this morning because there is only one splunkd.exe. I did a restart, which fixed it temporarily but it's settled down to one splunkd again now.

Is this something to worry about? Has something changed regarding processes?

Tags (1)
0 Karma
1 Solution

MHibbin
Influencer

srw46,

On Windows, there is only two processes running for Splunk... "Splunkd" and "Splunkweb".

On Linux, there are three processes running... two for splunkd and one for splunkweb (represented by python).

UPDATE: The following docs ... here ... mention that there are only two processes by default.

UPDATE: Just got the following output from two of my systems (one Win, one Linux)...

Windows:

C:\Program Files\Splunk\bin>splunk.exe status
Splunkd: Running (pid 3300)
Splunkweb: Running (pid 4092)

Linux:

/opt/splunk/bin # ./splunk status
splunkd is running (PID: 7097).
splunk helpers are running (PIDs: 7098 7148).
splunkweb is running (PID: 7969).

Think this maybe where the confusion arose?

regards,

MHibbin

View solution in original post

srw46
Path Finder

Many thanks, MHibbin.

0 Karma

MHibbin
Influencer

Hope this helps! 🙂

0 Karma

MHibbin
Influencer

srw46,

On Windows, there is only two processes running for Splunk... "Splunkd" and "Splunkweb".

On Linux, there are three processes running... two for splunkd and one for splunkweb (represented by python).

UPDATE: The following docs ... here ... mention that there are only two processes by default.

UPDATE: Just got the following output from two of my systems (one Win, one Linux)...

Windows:

C:\Program Files\Splunk\bin>splunk.exe status
Splunkd: Running (pid 3300)
Splunkweb: Running (pid 4092)

Linux:

/opt/splunk/bin # ./splunk status
splunkd is running (PID: 7097).
splunk helpers are running (PIDs: 7098 7148).
splunkweb is running (PID: 7969).

Think this maybe where the confusion arose?

regards,

MHibbin

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...