Deployment Architecture

Why do I need to restart Splunk daily

russellliss
Path Finder

We have recently upgraded to the 5.0.1 release, but are now seeing that we have to bounce splunk daily, otherwise most of the indexes do not get data. Once we bounce the search head and indexer, same instance, then it works for almost a day, and stops again. Any thoughts on trying to diagnose what the issue could be?

Tags (1)
0 Karma

MuS
Legend

Hi russellliss

have you installed the S.o.S. App link text this can help you finding the cause for the behavior.

cheers,

MuS

MuS
Legend

how about 'Warnings and Errors' or 'Resource Usage'.
You could also search index=_internal source="*splunkd.log*" err and see if you find something.
Have you checked the ulimit (if on *nix) for the user running splunkd?

0 Karma

russellliss
Path Finder

I have S.O.S. installed, but would not know where to start looking, as it looks like the agents are not reporting.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...