https://community.splunk.com/t5/Monitoring-Splunk/sometimes-splunkd-process-dies-automatically-and-does-not-start/m-p/103377#M1238 <P>It happened again. This times it died automatically while running. I greped on python process and found root.py script with parameter restart. I killed the splunk process and the process got killed too. I tried to start again. Same thing is happening as I mentioned in my last post. splunkd process starts and dies. I don't see anything in the log.</P> Thu, 03 Nov 2011 21:05:27 GMT asingla 2011-11-03T21:05:27Z https://community.splunk.com/t5/Monitoring-Splunk/sometimes-splunkd-process-dies-automatically-and-does-not-start/m-p/103375#M1236 <P>It happened twice with me now. I stop and start the splunk, splunkd and splunkweb starts but splunkd process dies immediately. I keep trying stop and start but same thing happens. I don't see any error in any of the log files. /var/log/splunk/. </P> <P>After almost 20-30 minutes if I try, everything works.</P> Thu, 03 Nov 2011 17:39:04 GMT https://community.splunk.com/t5/Monitoring-Splunk/sometimes-splunkd-process-dies-automatically-and-does-not-start/m-p/103375#M1236 asingla 2011-11-03T17:39:04Z https://community.splunk.com/t5/Monitoring-Splunk/sometimes-splunkd-process-dies-automatically-and-does-not-start/m-p/103376#M1237 <P>After you do a splunk stop, do a ps -ef and grep for splunk. If you see a python process running, you'll need to kill that, since that sometimes doesn't die and will prevent Splunk from coming back up again.</P> <P>If this isn't the issue, seeing the actual log entries from the time it dies would help. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 03 Nov 2011 19:41:07 GMT https://community.splunk.com/t5/Monitoring-Splunk/sometimes-splunkd-process-dies-automatically-and-does-not-start/m-p/103376#M1237 Sqig 2011-11-03T19:41:07Z https://community.splunk.com/t5/Monitoring-Splunk/sometimes-splunkd-process-dies-automatically-and-does-not-start/m-p/103377#M1238 <P>It happened again. This times it died automatically while running. I greped on python process and found root.py script with parameter restart. I killed the splunk process and the process got killed too. I tried to start again. Same thing is happening as I mentioned in my last post. splunkd process starts and dies. I don't see anything in the log.</P> Thu, 03 Nov 2011 21:05:27 GMT https://community.splunk.com/t5/Monitoring-Splunk/sometimes-splunkd-process-dies-automatically-and-does-not-start/m-p/103377#M1238 asingla 2011-11-03T21:05:27Z https://community.splunk.com/t5/Monitoring-Splunk/sometimes-splunkd-process-dies-automatically-and-does-not-start/m-p/103378#M1239 <P>I think the reason was I was using transformation. I need to reset the source/source-type based on data in the messages. To do that I used RegEx. It started crashing when the message load increased. Looks like it increased the indexing time and may be queue was full or something. I removed that and this didn't happen again. But the strange thing is there is nothing in the logs.</P> <P>The above logic is a guess though.</P> Wed, 09 Nov 2011 14:59:12 GMT https://community.splunk.com/t5/Monitoring-Splunk/sometimes-splunkd-process-dies-automatically-and-does-not-start/m-p/103378#M1239 asingla 2011-11-09T14:59:12Z