Why do I need to restart Splunk daily

[russellliss]

We have recently upgraded to the 5.0.1 release, but are now seeing that we have to bounce splunk daily, otherwise most of the indexes do not get data. Once we bounce the search head and indexer, same instance, then it works for almost a day, and stops again. Any thoughts on trying to diagnose what the issue could be?

[MuS]

Hi russellliss

have you installed the S.o.S. App link text this can help you finding the cause for the behavior.

cheers,

MuS

[MuS]

how about 'Warnings and Errors' or 'Resource Usage'.
You could also search index=_internal source="*splunkd.log*" err and see if you find something.
Have you checked the ulimit (if on *nix) for the user running splunkd?

[russellliss]

I have S.O.S. installed, but would not know where to start looking, as it looks like the agents are not reporting.