|
I want to avoid killing somebody else's search in the event I need to restart splunk. Is there any way to see all the searches being run right now in Splunk 4? |
|
If you are running Splunk on Linux you can also execute "ps -ef | grep search" from the command line. That would certainly work, but you jobs tab in the ui gives the percentage complete. So, you could just watch the search finish before restarting, instead of rerunning ps.
(10 Mar '10, 13:55)
thepocketwade
To add on to this comparison: the splunk-specific monitoring does know more about the searches, but the operating-system level inspection is an intended feature. If something is misbehaving, we want the tradiditional tools to be informative. renicing jobs is kosher, as is a goold old SIGQUIT, in a pinch. The windows equivalents should also be fine.
(11 Mar '10, 08:15)
jrodman ♦
But that only applies to Splunk 4.
(19 May '10, 14:27)
tpaulsen
|
|
And in Windows you can look in the Task Manager (or use Process Explorer, or whatever) and look for instances of |
