SIGTERM vs splunk stop

[davidgreenibm]

Is there a difference how to stop Splunk: using splunk stop or to send TERM signal. I'm using kuberntes and it sends TERM signal if it needs to stop a container therefore I need to understand the difference between this two options.

[PavelP]

the old "init" stop from /etc/init.d/splunk:

splunk_stop() {
  echo Stopping Splunk...
  "/opt/splunk/bin/splunk" stop
  RETVAL=$?
  [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/splunk

the new "systemd" stop from /etc/systemd/system/Splunkd.service:

[Service]
Type=simple
Restart=always
ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd
KillMode=mixed
KillSignal=SIGINT
TimeoutStopSec=360

where KillMode=mixed means:

 If set to mixed, the SIGTERM signal (see below) is sent to the main process while the subsequent SIGKILL signal (see below) is sent to all remaining processes of the unit's control group.  

where KillSignal=SIGINT:

Specifies which signal to use when stopping a service. This controls the signal that is sent as first step of shutting down a unit (see above), and is usually followed by SIGKILL (see above and below). For a list of valid signals, see signal(7). Defaults to SIGTERM.

Note that, right after sending the signal specified in this setting, systemd will always send SIGCONT, to ensure that even suspended tasks can be terminated cleanly.