Splunkd continuously restarts port 8089 on Search Head

[Haleb]

Hi there, after investigation my Search Head instance I found this in my task bar.

Can somebody say is it expected behaviour?

[richgalloway]

It's normal to see "splunkd -p 8089 restart" in the process list because that is the command that launched Splunk.  I'm not sure, however, about why it appears so many times.  AIUI, there should be a single "splunkd -p 8089 restart" process and additional "splunkd" processes for running searches.  I could be mistaken, however.

[PickleRick]

This seems to be some fancy modern top-like program. And I supose it shows separate threads of single splunkd process. Notice that the memory usage is identical for all those entries.

[livehybrid]

Hi @Haleb 

*Yes* - This is to be expected, this is based on how the Splunk instance was started. 

Essentially if Splunk started by "$SPLUNK_HOME/bin/splunk start" it will appended with "start", if it was "$SPLUNK_HOME/bin/splunk restart" it will be appended with "restart". If you use systemd then it could be something like "splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd"

Check out the following Community post with a little more info if interested: https://community.splunk.com/t5/Monitoring-Splunk/Difference-between-splunkd-p-8089-restart-or-splun...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@Haleb 

• Start by reviewing $SPLUNK_HOME/var/log/splunk/splunkd.log for specific error messages about the restart.

• Run netstat -tuln | grep 8089 or ss -tuln | grep 8089 to confirm if another process is using the port