Deployment Architecture

Why is a standalone search head going down often?


Hi ,

In our Splunk environment, standalone search head is going down often.
Could anyone , what would be the reason on this?

When i check SH internal logs,at time just before down time . I could see the below errors

2017-11-16 15:45:59,954 INFO [5a0d7dff217f35xxxxxxxx] root:129 - ENGINE: Bus EXITED
2017-11-16 15:45:59,954 INFO [5a0d7dff217f35xxxxxxxx] root:129 - ENGINE: Bus STOPPED
2017-11-16 15:45:59,953 INFO [5a0d7dff217f35xxxxxxxx] root:129 - ENGINE: Stopped thread '_TimeoutMonitor'.
2017-11-16 15:45:59,887 INFO [5a0d7dff217f35xxxxxxxx] root:129 - ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('', 8065)) shut down

Can someone help on this please?


0 Karma


Hi mala_splunk_91,
it's hard to debug a problem likethis!
what Linux are you using? see on internet if there are known issues on this Operative System.
Anyway, I suggest to open a case to Splunk Support because the only way is a webex to see you installation.

0 Karma


i know it's old thread ,i assume it helps ,
once check DMC on your search head , and go to "resource usage: instance"
check for Maximum Physical Memory Usage by Process Class& Maximum CPU Usage by Process Class
identify which process class consuming more resources , usually it is "search activity" in my case

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!