Monitoring Splunk
Highlighted

Splunk Architecture Documentation

Path Finder

I am interested in finding out more about how the splunk processes (splunkweb, splunkd, etc) work together to provide the overall splunk service. This includes the various logfiles, and ports. I've looked through the splunk docs site and see quite a bit of information and manuals there but I'm looking for a bit more of a detailed overview than what I see here:

http://www.splunk.com/view/SP-CAAABF9

and here:

http://docs.splunk.com/Documentation/Splunk/latest/installation/Splunksarchitectureandwhatgetsinstal...

Specifically, I'm looking for a deeper dive into ports, inter-communication and what to look for in truss/struss/strace, etc to determine how healthy the environment, and ultimately splunk service, is.

Any help would be greatly appreciated.

0 Karma
Highlighted

Re: Splunk Architecture Documentation

Splunk Employee
Splunk Employee

There is not an overall architecture topic like the one you describe. It sounds as if you are looking for troubleshooting information. There is a What Splunk logs about itself topic in the Troubleshooting Manual that you might want to look at.

There is some port information in the Admin Manual topic, "Change default values."

If you're having a specific issue with Splunk crashing, you might want to contact Splunk Support.

0 Karma
Highlighted

Re: Splunk Architecture Documentation

Path Finder

Thanks Chris,

I've glanced at the "What Splunk logs about itself" topic once before. I'll go through it again. I looked it over before installing Splunk on Splunk. I'll also check out the admin guide topic.

Thank you very much!

Jonathon

0 Karma