https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489327#M8763 <P>Hi @kartm,<BR /> it's very difficoult to understand what's happened without any info.<BR /> Anyway, start to see Splunk logs ($SPLUNK_HOME/var/log/splunk/splunkd.log or if there's a crash log.<BR /> then try to restart Splunk using console so you can see start-up messages and understand if there are error messages.<BR /> Ciao.<BR /> Giuseppe</P> Mon, 20 Jan 2020 13:49:32 GMT gcusello 2020-01-20T13:49:32Z https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489324#M8760 <P>I just need to find the reason of indexer down in splunk</P> Mon, 20 Jan 2020 13:28:31 GMT https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489324#M8760 kartm2020 2020-01-20T13:28:31Z https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489325#M8761 <P>you can start off by looking at splunkd logs (index=_internal source=*splunkd.log) and also look at /var/log/messages and look for events around the time the indexer went down.</P> Mon, 20 Jan 2020 13:38:39 GMT https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489325#M8761 soumyasaha25 2020-01-20T13:38:39Z https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489326#M8762 <P>Thank you. May i know what is the exact error message that comes in splunkd.log? Give me some sample output. it will help me a lot</P> Mon, 20 Jan 2020 13:40:36 GMT https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489326#M8762 kartm2020 2020-01-20T13:40:36Z https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489327#M8763 <P>Hi @kartm,<BR /> it's very difficoult to understand what's happened without any info.<BR /> Anyway, start to see Splunk logs ($SPLUNK_HOME/var/log/splunk/splunkd.log or if there's a crash log.<BR /> then try to restart Splunk using console so you can see start-up messages and understand if there are error messages.<BR /> Ciao.<BR /> Giuseppe</P> Mon, 20 Jan 2020 13:49:32 GMT https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489327#M8763 gcusello 2020-01-20T13:49:32Z https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489328#M8764 <P>it is quite difficult to tell the exact message that splunk will throw when an indexer goes down since it might go down for a variety of factors (maybe the disk/memory/cpu utilization had spiked), but you should be able to figure it out from the splunkd logs just look into the error logs (index=_internal source=*splunkd.log log_level=ERROR host=).</P> Wed, 30 Sep 2020 03:42:09 GMT https://community.splunk.com/t5/Splunk-Dev/How-could-i-find-the-reason-or-cause-of-indexer-down/m-p/489328#M8764 soumyasaha25 2020-09-30T03:42:09Z