On looking into the internal logs of the server on which forwarder is configured, I could observe that splunkd is shutting down for every 24 hours, and starting again. Below are the logs before the shut down,
09-06-2016 23:15:24.658 -0700 INFO ShutdownHandler - Shutting down splunkd
09-06-2016 23:15:24.253 -0700 INFO loader - Shutdown HTTPDispatchThread
09-06-2016 23:15:24.253 -0700 INFO loader - Shutdown HTTPDispatchThread
09-06-2016 23:15:23.987 -0700 INFO PipelineComponent - Performing early shutdown tasks
09-06-2016 23:15:23.987 -0700 INFO PipelineComponent - Performing early shutdown tasks
09-06-2016 23:14:57.092 -0700 INFO TcpOutputProc - Connected to idx=172.x.x.52:9997 using ACK.
09-06-2016 23:14:56.842 -0700 INFO StatusMgr - destHost=172.x.x.52, destIp=172.x.x.52, destPort=9997, eventType=connect_done, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor
Below are the logs after a restart has been done,
09-06-2016 23:16:16.829 -0700 WARN IConfCache - Stanza has an expansion [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\fmi_all_Splunk_TA_windows_inputs_installed_apps\bin\win_installed_apps.bat], ignoring alternate expansion [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\fmi_all_Splunk_TA_windows_inputs\bin\win_installed_apps.bat] in inputs.conf
09-06-2016 23:16:16.720 -0700 INFO loader - Automatic migration of modular inputs
09-06-2016 23:16:16.720 -0700 INFO loader - win-service: Splunk starting as a local administrator
09-06-2016 23:16:16.704 -0700 INFO loader - win-service: Starting as a Windows service: will run various system checks first...
What could be the reason for Splunkd to stop..And it is happening on a daily basis..What could be the reason behind it??
Does this restart at the same time every night, at 23:15? If so, most likely there is some script in windows that is restarting the services, and you should talk to your windows admins.
If the times are random, there is something else going on, maybe and upgrade to the latest version would help.