topic Why did Splunk restart heavy forwarder? in Getting Data In

Why did Splunk restart heavy forwarder?

wwhite12 — Wed, 22 Apr 2020 17:53:37 GMT

Got an alert for a HF restarting and trying to find the root cause of unexpected restart. I'm using the search below and the results shown are at the start of the event which led to the "Starting Splunk server daemon (splunkd)... " alert

index=_internal source="/opt/splunk/var/log/splunk/splunkd_st*" host=MYHF

Results:

    4/22/20
    1:14:38.000 PM  
    Checking prerequisites...

    4/22/20
    1:14:38.000 PM  
    Splunk> The IT Search Engine.

    4/22/20
    1:14:38.000 PM  
    splunkd is not running. [FAILED]

    4/22/20
    1:14:34.824 PM  
    2020-04-22 13:14:34.824 -0400 splunkd started (build 6db836e2fb9e) pid=25388

    4/22/20
    1:14:34.000 PM  
    Bypassing local license checks since this instance is configured with a remote license master.

Is there anywhere I could look that could give a more specific reason as to why the HF restarted?

Thanks in advance

Re: Why did Splunk restart heavy forwarder?

wwhite12 — Wed, 22 Apr 2020 17:55:23 GMT

The actual log of "Starting splunk server daemon (splunkd)... " also came in the query results but I only included the oldest events as they all happened at the same time but the most recent events were just Splunk preliminary restart procedures

Re: Why did Splunk restart heavy forwarder?

PavelP — Wed, 22 Apr 2020 18:14:05 GMT

Hello @wwhite12,

among several reasons, it could be the "Forwarder Mangement" which can restart Splunkd when an app is deployed.