Recently did a linux OS upgrade. On running healthchecks I noticed splunkd is not running on my index Cluster Master. Should it be? I am thinking not, since it's just for pushing updates to my Cluster, as I understand.
it must run there. Without it clustering and searching didn’t work. Of course it could be down for short times but not for long period. For troubleshooting check if there is anything weird on splunkd.log and resolve it before starting it. r. Ismo
