splunk restarting by it self

[max_ruas]

Hi,

(PRD) splunk@xxxxxxxx$ /opt/splunk/bin/splunk --version
Splunk 6.3.3 (build f44afce176d0)

I am getting tivali alerts for splunk Search Head restarting but when I look at the logs there is no mentioning of shutdown in splunkd.log for the time date specified.

what can I search for in splunkd.log to know when the system got last back up?
and is there any thing that could cause a unexpected restart? like a big search on the SH?

thanks

[jgbricker]

To determine when it last came up I’d try a search like- index=_internal source=*splunkd.log* “my guid is”. I’d investigate how tivali is monitoring your Splunk Instance in question. For example is it dependent on network and server availability of tivali itself. Also I would investigate changes like patches that may have impacted you. If you have Splunk support available run a diag command and open a case. It is very hard to just spitball what your specific issue may be.

http://docs.splunk.com/Documentation/Splunk/7.0.0/Troubleshooting/Generateadiag