Monitoring Splunk

Should splunkd be running on Cluster Master?

tk421
Engager

Recently did a linux OS upgrade. On running healthchecks I noticed splunkd is not running on my index Cluster Master. Should it be? I am thinking not, since it's just for pushing updates to my Cluster, as I understand.

 

Thanks.

Labels (3)
0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi

it must run there. Without it clustering and searching didn’t work. Of course it could be down for short times but not for long period. 
For troubleshooting check if there is anything weird on splunkd.log and resolve it before starting it. 
r. Ismo

tk421
Engager

Thank you. This is very helpful!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.