Service Not Stopping

[Heather Luna]

Hello!

It appears that Ansible is seeing the splunkd service as stopped although when I check the status on my test box, it's running. 

I use the same play earlier in the playbook to stop the service and it successfully changes. I'm stuck as to why it's seeing it as stopped when it's not. 

  - name: Stopping Splunkd Service in Preperation for Splunk Directory Removal

    win_service:

      name: Splunkd

      state: stopped

ok: [hostname.edu] => {"can_pause_and_continue": false, "changed": false, "depended_by": [], "dependencies": [], "description": "Splunkd is the indexing and searching engine for Splunk, a data platform for operational intelligence. It is required for Splunk instances acting as an indexer. If it is stopped, Splunk will not process data and will be unavailable for search. Splunkweb depends on Splunkd. Please see www.splunk.com for more information. Questions can be submitted to www.splunk.com/answers or for supported customers www.splunk.com/page/submit_issue", "desktop_interact": false, "display_name": "Splunkd Service", "exists": true, "name": "Splunkd", "path": "\"C:\\Program Files\\Splunk\\bin\\splunkd.exe\" service", "start_mode": "auto", "state": "stopped", "username": "LocalSystem"}

PLAY RECAP *****************************************************************************************

hostname.edu : ok=2    changed=0    unreachable=0    failed=0   

So confused. 

[Heather Luna]

UPDATE:

A more direct approach of 

 - name: Stopping Splunkd Service in Preperation for Splunk Directory Removal

    win_command: splunk stop

    args:

      chdir: 'C:\Program Files\SplunkUniversalForwarder\bin'

Yields the results I'd expect. Still confused as to why the win_service module wasn't working though so if anyone has any thoughts - open to hearing them! 

[Jordan Borean]

That sounds weird, sounds like the service was stopped but was eventually restarted once win_service was finished. Maybe there is another service that ensures it stays running and using splunk.exe to stop the service stops them all.

You can test it out by running

Stop-Service -Name Splunkd

locally and seeing if the service stays stopped.

If it does stay stopped then checking the event logs to see what occurs when win_service is running might indicate what might be happening.

I believe the service does actually stop as the return value "state" is stopped and that is directly derived from the service itself right before the module finishes as set inhttps://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win_service.ps1#L435.

Thanks

Jordan