After upgrading our Splunk indexers from 6.2.2 to 6.2.4, why did the splunkd service stop twice and had to be restarted?

[arber]

Hello,

Two days ago, we upgraded the Splunk version on our indexers from 6.2.2. to 6.2.4. However, we are facing an issue where the splunkd service is stopped. It happened two times on all our indexers. After restarting the service again, everything comes back to normal.

Has anyone experienced this issue with the new Splunk version?

Thanks

[southeringtonp]

Try upgrading again to 6.2.5. There's a good chance it's related to a known issue, SPL-104017. We observed a similar issue that appears so far to be fixed with the update. You can also try looking at the crashlog in $SPLUNK_HOME/var/log/splunk/ to see if there's anything of use there.

http://docs.splunk.com/Documentation/Splunk/6.2.5/ReleaseNotes/6.2.5

[arber]

on /opt/splunk/var/log/splunk we can find crash-2015-07-28-06:25:03.log

[build 271043] 2015-07-28 06:25:03
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID 2365 running under UID 0.
Crashing thread: MainTailingThread

[rongshengfang]

I am having the same issue and have just opened a Splunk support case today.

[arber]

Hi, did you get any response from them ?