Start and stop Splunk Enterprise
This topic provides brief instructions for starting and stopping Splunk Enterprise.
Start Splunk Enterprise on Windows
On Windows, Splunk Enterprise installs by default into C:\Program Files\Splunk
. Many examples in the Splunk documentation use $SPLUNK_HOME
to indicate the Splunk installation directory. You can replace the string $SPLUNK_HOME
(and the Windows variant %SPLUNK_HOME%
) with C:\Program Files\Splunk
if you installed Splunk Enterprise into the default directory.
Splunk Enterprise installs with two services, splunkd
and splunkweb
. In normal operation, only splunkd
runs, handling all Splunk Enterprise operations, including the Splunk Web interface. To change this, you must put Splunk Enterprise in legacy mode. Read Start Splunk Enterprise on Windows in legacy mode.
You can start and stop Splunk on Windows in one of the following ways:
1. Start and stop Splunk Enterprise processes via the Windows Services control panel (accessible from Start -> Control Panel -> Administrative Tools -> Services
)
- Server daemon and Web interface:
splunkd
- Web interface (in legacy mode only):
splunkweb
. In normal operation, this service starts, then immediately quits when it receives a start request.
2. Start and stop Splunk Enterprise services from a command prompt by using the NET START <service>
or NET STOP <service>
commands:
- Server daemon and Web interface:
splunkd
- Web interface (in legacy mode only):
splunkweb
. In normal operation, this service starts, then immediately quits when it receives a start request.
3. Start, stop, or restart both processes at once by going to %SPLUNK_HOME%\bin
and typing
> splunk [start|stop|restart]
Start Splunk Enterprise on Windows in legacy mode
If you want run Splunk Enterprise in legacy mode, where splunkd
and splunkweb
both run, you must change a configuration parameter.
Important: Do not run Splunk Web in legacy mode permanently. Use legacy mode to temporarily work around issues introduced by the new integration of the user interface with the main splunkd service. Once you correct the issues, return Splunk Web to normal mode as soon as possible.
To put Splunk Enterprise in legacy mode:
1. From a command prompt, go to %SPLUNK_HOME%\etc\system\local
.
2. Edit %SPLUNK_HOME%\etc\system\local\web.conf
, or create a new file named web.conf in %SPLUNK_HOME%\etc\system\local
if one does not already exist. See How to edit a configuration file.
3. In web.conf
, set the appserverPorts
and httpport
attributes as follows:
[settings] appServerPorts = 0 httpport = 8000
4. Save the file and close it.
5. Restart Splunk Enterprise. The splunkd
and splunkweb
services start and remain running.
6. Log into Splunk Enterprise by browsing to http://<server name>:<httpport>
and entering your credentials.
To restore normal Splunk Enterprise operations, edit %SPLUNK_HOME%\etc\system\local\web.conf
to remove the appServerPorts
and httpport
attributes.
Start Splunk Enterprise on UNIX
Splunk Enterprise installs with one process on *nix, splunkd
. In normal operation, only splunkd
runs, handling all Splunk Enterprise operations, including the Splunk Web interface. To change this, you must put Splunk Enterprise in legacy mode. See "Start Splunk Enterprise on Unix in legacy mode."
Start Splunk Enterprise
From a shell prompt on the Splunk Enterprise server host, run this command:
# splunk start
Note: If you have configured Splunk Enterprise to start at boot time, you should start it using the service command. This ensures that the user configured in the init.d script starts the software.
# service splunk start
This starts splunkd
(indexer and the Splunk Web interface).
To start them individually, type:
# splunk start splunkd
or
(in legacy mode only) # splunk start splunkweb
Note: If either the startwebserver
attribute is disabled, or the appServerPorts
attribute is set to anything other than 0 in web.conf
, then manually starting splunkweb
does not do anything. The splunkweb
process will not start in either case. See Start Splunk Enterprise on Unix in legacy mode."
To restart Splunk Enterprise (splunkd
or splunkweb
) type:
# splunk restart
# splunk restart splunkd
(in legacy mode only) # splunk restart splunkweb
Start Splunk Enterprise on Unix in legacy mode
If you want run Splunk Enterprise in such a way that splunkd
and splunkweb
both run, you must put Splunk Enterprise into legacy mode.
To put Splunk Enterprise in legacy mode:
1. From a shell prompt, go to $SPLUNK_HOME/etc/system/default
.
2. Make a copy of web.conf
and place it into $SPLUNK_HOME/etc/system/local
.
3. Edit web.conf
in $SPLUNK_HOME/etc/system/local
.
4. In web.conf
, set the appserverPorts
and httpport
attributes as follows:
[settings] appServerPorts = 0 httpport = 8000
5. Save the file and close it.
6. Restart Splunk Enterprise (see "Start Splunk Enterprise on Unix"). The splunkd
and splunkweb
services start and remain running.
7. Log into Splunk Enterprise by browsing to http://<server name>:<httpport>
and entering your credentials.
To restore normal Splunk Enterprise operations: edit %SPLUNK_HOME%\etc\system\local\web.conf
and remove the appServerPorts
and httpport
attributes.
Stop Splunk Enterprise
To shut down Splunk Enterprise, run this command:
# splunk stop
To stop splunkd
and Splunk Web individually, type:
# splunk stop splunkd
or
(in legacy mode only) # splunk stop splunkweb
Check if Splunk is running
To check if Splunk Enterprise is running, type this command at the shell prompt on the server host:
# splunk status
You should see this output:
splunkd is running (PID: 3162). splunk helpers are running (PIDs: 3164).
If Splunk Enterprise runs in legacy mode, you will see an additional line in the output:
splunkweb is running (PID: 3216).
Note: On Unix systems, you must be logged in as the user who runs Splunk Enterprise to run the splunk status
command. Other users cannot read the necessary files to report status correctly.
If splunk status
decides that the service is running it will return the status code 0, or success. If splunk status
determines that the service is not running it will return the Linux Standard Base value for a non-running service, 3. Other values likely indicate splunk status
has encountered an error.
You can also use ps
to check for running Splunk Enterprise processes:
# ps aux | grep splunk | grep -v grep
Solaris users should use the -ef
arguments to ps
instead of aux
:
# ps -ef | grep splunk | grep -v grep
Restart Splunk Enterprise from Splunk Web
You can also restart Splunk from Splunk Web:
1. Navigate to Settings > Server controls.
2. Click Restart Splunk.
This will restart the splunkd
and (in legacy mode only) the splunkweb
processes.
Customize the CLI login banner | Configure Splunk Enterprise to start at boot time |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9
Feedback submitted, thanks!