Splunk Enterprise

Splunkd continuously restarts port 8089 on Search Head

Haleb
Path Finder

Hi there, after investigation my Search Head instance I found this in my task bar.

Screenshot 2025-04-17 at 3.20.53 PM.png

Can somebody say is it expected behaviour?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's normal to see "splunkd -p 8089 restart" in the process list because that is the command that launched Splunk.  I'm not sure, however, about why it appears so many times.  AIUI, there should be a single "splunkd -p 8089 restart" process and additional "splunkd" processes for running searches.  I could be mistaken, however.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

This seems to be some fancy modern top-like program. And I supose it shows separate threads of single splunkd process. Notice that the memory usage is identical for all those entries.

livehybrid
Champion

Hi @Haleb 

*Yes* - This is to be expected, this is based on how the Splunk instance was started. 

Essentially if Splunk started by "$SPLUNK_HOME/bin/splunk start" it will appended with "start", if it was "$SPLUNK_HOME/bin/splunk restart" it will be appended with "restart". If you use systemd then it could be something like "splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd"

Check out the following Community post with a little more info if interested: https://community.splunk.com/t5/Monitoring-Splunk/Difference-between-splunkd-p-8089-restart-or-splun...

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

kiran_panchavat
Influencer

@Haleb 

  • Start by reviewing $SPLUNK_HOME/var/log/splunk/splunkd.log for specific error messages about the restart.
  • Run netstat -tuln | grep 8089 or ss -tuln | grep 8089 to confirm if another process is using the port
Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...