Deployment Architecture

Splunkd service goes down every 24 hours on the forwarder

yashwanth_g_pra
Observer

On looking into the internal logs of the server on which forwarder is configured, I could observe that splunkd is shutting down for every 24 hours, and starting again. Below are the logs before the shut down,

09-06-2016 23:15:24.658 -0700 INFO ShutdownHandler - Shutting down splunkd

09-06-2016 23:15:24.253 -0700 INFO loader - Shutdown HTTPDispatchThread

09-06-2016 23:15:24.253 -0700 INFO loader - Shutdown HTTPDispatchThread

09-06-2016 23:15:23.987 -0700 INFO PipelineComponent - Performing early shutdown tasks

09-06-2016 23:15:23.987 -0700 INFO PipelineComponent - Performing early shutdown tasks

09-06-2016 23:14:57.092 -0700 INFO TcpOutputProc - Connected to idx=172.x.x.52:9997 using ACK.

09-06-2016 23:14:56.842 -0700 INFO StatusMgr - destHost=172.x.x.52, destIp=172.x.x.52, destPort=9997, eventType=connect_done, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor

Below are the logs after a restart has been done,

09-06-2016 23:16:16.829 -0700 WARN IConfCache - Stanza has an expansion [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\fmi_all_Splunk_TA_windows_inputs_installed_apps\bin\win_installed_apps.bat], ignoring alternate expansion [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\fmi_all_Splunk_TA_windows_inputs\bin\win_installed_apps.bat] in inputs.conf

09-06-2016 23:16:16.720 -0700 INFO loader - Automatic migration of modular inputs

09-06-2016 23:16:16.720 -0700 INFO loader - win-service: Splunk starting as a local administrator

09-06-2016 23:16:16.704 -0700 INFO loader - win-service: Starting as a Windows service: will run various system checks first...

What could be the reason for Splunkd to stop..And it is happening on a daily basis..What could be the reason behind it??

Tags (1)
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Does this restart at the same time every night, at 23:15? If so, most likely there is some script in windows that is restarting the services, and you should talk to your windows admins.

If the times are random, there is something else going on, maybe and upgrade to the latest version would help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...