Deployment Architecture

Splunk with Ubuntu 12.04

Engager

Hi ,

I have installed Splunk on Ubuntu 12.04 LTS .deb package. splunk is working fine for 1 day. after that server is getting frequently getting hung. i have stopped splunk & tested server is working fine. when i start Splunk i get the same issue of server hanging.
does Splunk has any OS dependency ? will Splunk wont work on Ubuntu 12.04 LTS ?
can anyone help me on this ?

Tags (1)

Splunk Employee
Splunk Employee

I would recommend removing the .deb package and installing via the .tgz file. I am a Debian/Ubuntu junky and have had issues in the past with the .deb file. It works flawlessly on some, doesn't work as smoothly on others. As far as dependencies, Splunk is a completely self-contained application. Even the Python and web server Splunk uses is self-contained. Let us know if you this corrects your problem.

On the off-chance that you prefer not to reinstall, please install Splunk-on-Splunk from Splunk-base and allow that to do the heavy lifting for you while troubleshooting your issues. SoS pulls all of it's data from the _internal index, essentially giving you a visualization of what Drainy recommended.

Ultra Champion

Just to add , no issues here running on 12.04 from the tarball.

0 Karma

Champion

If you do a search for index=_internal source=*splunkd.log does it show any errors or problems around the times it hangs?

0 Karma