Hello Splunkers,
Splunk crashes on our Linux core servers (Master, Search Heads and Heavy Forwarders, indexers are not affected) with "ENGINE: Bus STOPPED" errors.
When I check splunkd status on host, it turns out that:
se1234@z1il1234:~> /opt/splunk/bin/splunk status
splunkd 130820 was not running.
Stopping splunk helpers...Done.
Stopped helpers.
Removing stale pid file... done.
It is an intermittent issue. Today in the morning we had this issue on SH1, yesterday on another SH2 and a week before on SH4. We have checked Resource usage and there is nothing shown in DMC that may cause splunkd to crash (e.g. high CPU usage)
Any idea what is worth checking or how to troubleshoot?
Greetings,
Dzasta
