Splunk with Ubuntu 12.04

[mandadi]

Hi ,

I have installed Splunk on Ubuntu 12.04 LTS .deb package. splunk is working fine for 1 day. after that server is getting frequently getting hung. i have stopped splunk & tested server is working fine. when i start Splunk i get the same issue of server hanging.
does Splunk has any OS dependency ? will Splunk wont work on Ubuntu 12.04 LTS ?
can anyone help me on this ?

[mwhite_splunk]

I would recommend removing the .deb package and installing via the .tgz file. I am a Debian/Ubuntu junky and have had issues in the past with the .deb file. It works flawlessly on some, doesn't work as smoothly on others. As far as dependencies, Splunk is a completely self-contained application. Even the Python and web server Splunk uses is self-contained. Let us know if you this corrects your problem.

On the off-chance that you prefer not to reinstall, please install Splunk-on-Splunk from Splunk-base and allow that to do the heavy lifting for you while troubleshooting your issues. SoS pulls all of it's data from the _internal index, essentially giving you a visualization of what Drainy recommended.

[Damien_Dallimor]

Just to add , no issues here running on 12.04 from the tarball.

[Drainy]

If you do a search for index=_internal source=*splunkd.log does it show any errors or problems around the times it hangs?