Got an alert for a HF restarting and trying to find the root cause of unexpected restart. I'm using the search below and the results shown are at the start of the event which led to the "Starting Splunk server daemon (splunkd)... " alert
index=_internal source="/opt/splunk/var/log/splunk/splunkd_st*" host=MYHF
Results:
4/22/20
1:14:38.000 PM
Checking prerequisites...
4/22/20
1:14:38.000 PM
Splunk> The IT Search Engine.
4/22/20
1:14:38.000 PM
splunkd is not running. [FAILED]
4/22/20
1:14:34.824 PM
2020-04-22 13:14:34.824 -0400 splunkd started (build 6db836e2fb9e) pid=25388
4/22/20
1:14:34.000 PM
Bypassing local license checks since this instance is configured with a remote license master.
Is there anywhere I could look that could give a more specific reason as to why the HF restarted?
Thanks in advance
Hello @wwhite12,
among several reasons, it could be the "Forwarder Mangement" which can restart Splunkd when an app is deployed.
The actual log of "Starting splunk server daemon (splunkd)... " also came in the query results but I only included the oldest events as they all happened at the same time but the most recent events were just Splunk preliminary restart procedures