Splunk Architecture Documentation

[jonathon]

I am interested in finding out more about how the splunk processes (splunkweb, splunkd, etc) work together to provide the overall splunk service. This includes the various logfiles, and ports. I've looked through the splunk docs site and see quite a bit of information and manuals there but I'm looking for a bit more of a detailed overview than what I see here:

http://www.splunk.com/view/SP-CAAABF9

and here:

http://docs.splunk.com/Documentation/Splunk/latest/installation/Splunksarchitectureandwhatgetsinstal...

Specifically, I'm looking for a deeper dive into ports, inter-communication and what to look for in truss/struss/strace, etc to determine how healthy the environment, and ultimately splunk service, is.

Any help would be greatly appreciated.

[ChrisG]

There is not an overall architecture topic like the one you describe. It sounds as if you are looking for troubleshooting information. There is a What Splunk logs about itself topic in the Troubleshooting Manual that you might want to look at.

There is some port information in the Admin Manual topic, "Change default values."

If you're having a specific issue with Splunk crashing, you might want to contact Splunk Support.

[jonathon]

Thanks Chris,

I've glanced at the "What Splunk logs about itself" topic once before. I'll go through it again. I looked it over before installing Splunk on Splunk. I'll also check out the admin guide topic.

Thank you very much!

Jonathon