topic Splunkd continuously restarts port 8089 on Search Head in Splunk Enterprise

Splunkd continuously restarts port 8089 on Search Head

Haleb — Thu, 17 Apr 2025 12:22:51 GMT

Hi there, after investigation my Search Head instance I found this in my task bar.

Can somebody say is it expected behaviour?

Re: Splunkd continuously restarts port 8089 on Search Head

kiran_panchavat — Thu, 17 Apr 2025 12:36:39 GMT

@Haleb

Start by reviewing $SPLUNK_HOME/var/log/splunk/splunkd.log for specific error messages about the restart.

Run netstat -tuln | grep 8089 or ss -tuln | grep 8089 to confirm if another process is using the port

Re: Splunkd continuously restarts port 8089 on Search Head

livehybrid — Thu, 17 Apr 2025 13:42:10 GMT

Hi @Haleb

*Yes* - This is to be expected, this is based on how the Splunk instance was started.

Essentially if Splunk started by "$SPLUNK_HOME/bin/splunk start" it will appended with "start", if it was "$SPLUNK_HOME/bin/splunk restart" it will be appended with "restart". If you use systemd then it could be something like "splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd"

Check out the following Community post with a little more info if interested: https://community.splunk.com/t5/Monitoring-Splunk/Difference-between-splunkd-p-8089-restart-or-splunkd-p-8089/m-p/255553

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunkd continuously restarts port 8089 on Search Head

richgalloway — Thu, 17 Apr 2025 13:45:05 GMT

It's normal to see "splunkd -p 8089 restart" in the process list because that is the command that launched Splunk. I'm not sure, however, about why it appears so many times. AIUI, there should be a single "splunkd -p 8089 restart" process and additional "splunkd" processes for running searches. I could be mistaken, however.

Re: Splunkd continuously restarts port 8089 on Search Head

PickleRick — Thu, 17 Apr 2025 18:53:47 GMT

This seems to be some fancy modern top-like program. And I supose it shows separate threads of single splunkd process. Notice that the memory usage is identical for all those entries.