Configure splunkweb to stop when splunkd crashes

[aengelstad]

We've unfortunately had a few instances now where for various reasons the splunkd processes crashes or otherwise stops. Unfortunately the splunkweb process keeps running and presenting a login page HTTP/200 so our load balancer keeps it in the pool.

Ideally there would be a config to have splunkweb shutdown then the splunkd process returns HTTP4XX/5XX or timeouts however I can't see that anywhere.

Worst case I could write a shell script and cron it, but I'm trying to avoid that if I can.

Obviously the easy answer would be to stop splunkd from crashing, but I figure it's better to plan for failure.

[MuS]

Hi aengelstad,

try to use MartinMcNutt's suggestion and have the load balancer also test on port 8089 and if this fails remove port 8000 from the load balancer pool. Other solution would be the script cron job that you suggested.

cheers, MuS

[MartinMcNutt]

What about doing the health check against port 8089 too? Not sure what load balancer you have but I would give high priority to the check on 8089 then 8000.