Monitoring Splunk

Splunk Architecture Documentation

jonathon
Path Finder

I am interested in finding out more about how the splunk processes (splunkweb, splunkd, etc) work together to provide the overall splunk service. This includes the various logfiles, and ports. I've looked through the splunk docs site and see quite a bit of information and manuals there but I'm looking for a bit more of a detailed overview than what I see here:

http://www.splunk.com/view/SP-CAAABF9

and here:

http://docs.splunk.com/Documentation/Splunk/latest/installation/Splunksarchitectureandwhatgetsinstal...

Specifically, I'm looking for a deeper dive into ports, inter-communication and what to look for in truss/struss/strace, etc to determine how healthy the environment, and ultimately splunk service, is.

Any help would be greatly appreciated.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

There is not an overall architecture topic like the one you describe. It sounds as if you are looking for troubleshooting information. There is a What Splunk logs about itself topic in the Troubleshooting Manual that you might want to look at.

There is some port information in the Admin Manual topic, "Change default values."

If you're having a specific issue with Splunk crashing, you might want to contact Splunk Support.

0 Karma

jonathon
Path Finder

Thanks Chris,

I've glanced at the "What Splunk logs about itself" topic once before. I'll go through it again. I looked it over before installing Splunk on Splunk. I'll also check out the admin guide topic.

Thank you very much!

Jonathon

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...