Start and stop Splunk Enterprise

This topic provides common methods for starting and stopping Splunk Enterprise.

Start Splunk Enterprise on Windows

Splunk Enterprise installations are placed into the path C:\Program Files\Splunk by default. The documentation will refer to this default path as %SPLUNK_HOME% . Splunk Enterprise installs one service named splunkd . In normal operation, only the splunkd service runs and handles all Splunk Enterprise operations, including the Splunk Web interface.

You can start and stop Splunk Enterprise on Windows in one of the following ways:

Use the Windows Services control panel.

Click the Start Button and type "services."

Select the Services control panel option.

In the Services control panel, find the


      Splunkd Service

service.

Start or stop the service.

Use the NET START or NET STOP commands.

Open an administrative command prompt.

Type:


      NET START splunkd

or


      NET STOP splunkd

.

Use the Splunk Enterprise executable.

Open an administrative command prompt.

Change the path to


      %SPLUNK_HOME%\bin

.

Type:


      splunk [start|stop|restart]

.

Start Splunk Enterprise on *nix

Splunk Enterprise installations using a package (.rpm or .deb) will install into the path /opt/splunk by default. The documentation will refer to this default path as $SPLUNK_HOME . Splunk Enterprise installs one process named splunkd . In normal operation, only the splunkd process runs and handles all Splunk Enterprise operations, including the Splunk Web interface.

You can start and stop Splunk Enterprise on *nix in one of the following ways:

Use the Splunk Enterprise process.

Log in as the user account running Splunk Enterprise processes.

Open a shell prompt.

Change the path to


      $SPLUNK_HOME/bin

Type:


      splunk [start|stop|restart]

.

Use a service command. If you configured Splunk Enterprise to start at boot time, you will interact with the process using the service command. Using the service command ensures that the user configured in the init.d script starts the process. See Enable boot-start on *nix platforms .

Open a shell prompt.

Type:


      splunkd service [start|stop|restart]

.

Use systemd commands. If you configured Splunk Enterprise to use systemd, you will interact with the process using the systemctl command. See Configure systemd using enable boot-start .

Open a shell prompt.

Type:


      systemctl [start|stop|restart] Splunkd.service

.

Restart Splunk Enterprise from Splunk Web

You can restart Splunk Enterprise from Splunk Web:

Log into Splunk Web as an admin role

In Splunk Web, go to Settings > Server controls

Select "Restart Splunk"

Check if Splunk Enterprise is running

To verify that the Splunk Enterprise processes are running:

Use the "status" command on *nix.

Log in as the user account running Splunk Enterprise processes.

Open a shell prompt.

Change the path to


      $SPLUNK_HOME/bin

.

Type:


      splunk status

.

Use the "status" command on Windows.

Open an administrative command prompt.

Change the path to


      %SPLUNK_HOME%\bin

.

Type:


      splunk status

.

Use the process viewer command on *nix

Open a shell prompt.

Type:


      ps aux | grep splunkd | grep -v grep

.

Look for running processes.

Use the process list command on Windows.

Open a powershell prompt.

Type:


      Get-process splunkd

.

Look for running processes.

This documentation applies to the following versions of Splunk ^® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.2.0, 9.2.1

Comments

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers . out of 1000 Characters

Submit Comment We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here » Closing this box indicates that you accept our Cookie Policy.