How can you set Splunk to restart automatically when it goes down?

[julian0125]

Hello Splunkers,

I need your help once again.

Is there a way to restart Splunk automatically when it goes down? Unfortunately, we don't have permission to use CRON, but we are making a test with a shell (.sh) into the server to call the "./splunk restart" command, but it doesn't work for itself. I need to put manually the shell using " sh XXX.sh" command.

Thanks for your help

[chrisyounger]

Splunk really shouldn't be going down. You should look try to determine why by looking at index=_internal source=*crash*.

If you can't fix this then I would recommend using SystemD which can automatically restart Splunk for you. This is the default in 7.2.x splunk versions. Even if you are using an older splunk you can setup Splunkd by using the unit file from this page: https://docs.splunk.com/Documentation/Splunk/7.2.2/Admin/RunSplunkassystemdservice#Configure_systemd...

From that link, you can see that it is already set to Restart=always these exit codes are important:

SuccessExitStatus=51 52
RestartPreventExitStatus=51
RestartForceExitStatus=52

All the best.