topic Re: No activity in Splunkd Threads on indexer in Monitoring Splunk

No activity in Splunkd Threads on indexer

cfernaca — Thu, 16 Jan 2025 11:35:42 GMT

Hi,

Looking at the activity of the Splunkd threads on the indexers, I've seen in the monitoring console that sometimes there is no activity for a period of 1 minute. Is this normal?

evidence

Regards, thank you very much

Re: No activity in Splunkd Threads on indexer

isoutamo — Thu, 16 Jan 2025 12:51:33 GMT

Usually there are events for every 30s or something like this. Probably your environment has some hickups or it’s stalled for some reason? It’s hard to say more without more information about your setups and os, hw knowledge.

Re: No activity in Splunkd Threads on indexer

cfernaca — Thu, 16 Jan 2025 15:03:53 GMT

Hi,

I have a indexers cluster with 4 indexers. All indexers have 8.1.14 splunk version. The OS of servers are RedHat 7.9. The indexers cluster are multisite. We have two sites. Each of sites have two server associated. In addition, we have a cluster manager, search heads cluster, development search head, development indexer and deployment server. All instances have splunk 8.1.14.

I see the Splunkd Thread Activity looking for possible clues to a problem we have when indexing data in production. The problem is that sometime we don't have some events in production. Not matter what sourcetype or method used to ingest data. We suspect that can be problem of indexers or of index where data is ingested.

Re: No activity in Splunkd Threads on indexer

cfernaca — Thu, 16 Jan 2025 16:11:35 GMT

Hi,