Splunkd service goes down every 24 hours on the forwarder

[yashwanth_g_pra]

On looking into the internal logs of the server on which forwarder is configured, I could observe that splunkd is shutting down for every 24 hours, and starting again. Below are the logs before the shut down,

09-06-2016 23:15:24.658 -0700 INFO ShutdownHandler - Shutting down splunkd

09-06-2016 23:15:24.253 -0700 INFO loader - Shutdown HTTPDispatchThread

09-06-2016 23:15:24.253 -0700 INFO loader - Shutdown HTTPDispatchThread

09-06-2016 23:15:23.987 -0700 INFO PipelineComponent - Performing early shutdown tasks

09-06-2016 23:15:23.987 -0700 INFO PipelineComponent - Performing early shutdown tasks

09-06-2016 23:14:57.092 -0700 INFO TcpOutputProc - Connected to idx=172.x.x.52:9997 using ACK.

09-06-2016 23:14:56.842 -0700 INFO StatusMgr - destHost=172.x.x.52, destIp=172.x.x.52, destPort=9997, eventType=connect_done, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor

Below are the logs after a restart has been done,

09-06-2016 23:16:16.829 -0700 WARN IConfCache - Stanza has an expansion [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\fmi_all_Splunk_TA_windows_inputs_installed_apps\bin\win_installed_apps.bat], ignoring alternate expansion [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\fmi_all_Splunk_TA_windows_inputs\bin\win_installed_apps.bat] in inputs.conf

09-06-2016 23:16:16.720 -0700 INFO loader - Automatic migration of modular inputs

09-06-2016 23:16:16.720 -0700 INFO loader - win-service: Splunk starting as a local administrator

09-06-2016 23:16:16.704 -0700 INFO loader - win-service: Starting as a Windows service: will run various system checks first...

What could be the reason for Splunkd to stop..And it is happening on a daily basis..What could be the reason behind it??

[esix_splunk]

Does this restart at the same time every night, at 23:15? If so, most likely there is some script in windows that is restarting the services, and you should talk to your windows admins.

If the times are random, there is something else going on, maybe and upgrade to the latest version would help.