Splunk Dev

where does splunk store the logs which specify starting/stoping the splunk ?

AKG1_old1
Builder

Hi,

I want to keep track of splunk startup and stop.

I have checked splunkd.log file but its not clearly specifying started/stopped sucessfully. Even when we start/stop Splunk using command line. It shows message like below on screen. Not sure if same information is stored in some file.

Starting splunk server daemon (splunkd)...
Done
[ OK ]

Stopping splunk helpers...
[ OK ]
Done.

Question:
Is there any logs which specify that splunk started /stopped successfully ?

Thanks
Ankit

Tags (1)
1 Solution

woodcock
Esteemed Legend

I doubt stdout for restarts is stored directly but there is similar stuff inside $SPLUNK_HOME/var/log/splunk/splunkd.log and also mongod.log; look for "stop*", "clos*", "shut*", and "flush*". If you are looking something else, check out audit.log; I am sure there is a clear "splunk was shut down" and "splunk was started" event there. You can try a search like this:

index=_* stop* OR start* OR clos* OR shut OR flush*

And then look at the Patterns tab to clump events.

View solution in original post

woodcock
Esteemed Legend

I doubt stdout for restarts is stored directly but there is similar stuff inside $SPLUNK_HOME/var/log/splunk/splunkd.log and also mongod.log; look for "stop*", "clos*", "shut*", and "flush*". If you are looking something else, check out audit.log; I am sure there is a clear "splunk was shut down" and "splunk was started" event there. You can try a search like this:

index=_* stop* OR start* OR clos* OR shut OR flush*

And then look at the Patterns tab to clump events.

AKG1_old1
Builder

Thank you 🙂

audit.log worked perfect for me as we are already monitoring audit.log

action=splunkShuttingDown
action=splunkStarting

skoelpin
SplunkTrust
SplunkTrust

It should be in splunkd_stderr.log

$SPLUNK_HOME/var/log/splunk

http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/WhatSplunklogsaboutitself

0 Karma

AKG1_old1
Builder

Thanks for your help !! splunkd_stderr.log shows following message.

2017-02-23 16:44:04.148 +0100 splunkd started (build 59c8927def0f) For startup
2017-02-23 16:44:25.885 +0100 Interrupt signal received - for stop

but audit.log worked perfect for me as we are already monitoring audit.log
audit.log
action=splunkShuttingDown
action=splunkStarting

Thanks
Ankit

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...