Deployment Architecture

How can you set Splunk to restart automatically when it goes down?


Hello Splunkers,

I need your help once again.

Is there a way to restart Splunk automatically when it goes down? Unfortunately, we don't have permission to use CRON, but we are making a test with a shell (.sh) into the server to call the "./splunk restart" command, but it doesn't work for itself. I need to put manually the shell using " sh" command.

Thanks for your help

Tags (1)
0 Karma


Splunk really shouldn't be going down. You should look try to determine why by looking at index=_internal source=*crash*.

If you can't fix this then I would recommend using SystemD which can automatically restart Splunk for you. This is the default in 7.2.x splunk versions. Even if you are using an older splunk you can setup Splunkd by using the unit file from this page:

From that link, you can see that it is already set to Restart=always these exit codes are important:

SuccessExitStatus=51 52

All the best.

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...