Hi looking for help , splunkforwarder service status is not running, but the splunkforwarder service is generating logs and we are able see the internal logs in cli as well as in ui, need to know which cause it's showing splunk service is not running. splunk@:/opt/splunkforwarder/bin$ ./splunk status splunkd is not running. splunk@:/opt/splunkforwarder/bin$ ./splunk version Splunk Universal Forwarder 6.5.2 splunk@:/opt/splunkforwarder/bin$ ps -ef|grep splunkd splunk 15913 1 3 06:01 ? 00:11:54 splunkd -p 8089 start splunk 15914 15913 0 06:01 ? 00:00:00 [splunkd pid=15913] splunkd -p 8089 start [process-runner] splunk 18627 18439 0 11:13 pts/1 00:00:00 grep splunkd splunk@:/opt/splunkforwarder/bin$ date Thu Feb 18 11:14:20 UTC 2021 splunk@:/opt/splunkforwarder/bin$ cd /opt/splunkforwarder/var/log/splunk/ splunk@:/opt/splunkforwarder/var/log/splunk$ tail -5 splunkd.log 02-18-2021 11:14:31.788 +0000 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_XXXXXXX_8089_XXXXXXXXX_0D56BD7C-435F-43C3-9C3D-46732D507E0C 02-18-2021 11:14:40.477 +0000 INFO WatchedFile - Resetting fd to re-extract header. 02-18-2021 11:14:43.716 +0000 INFO TcpOutputProc - Connected to idx=XXXXXX:9998 using ACK. 02-18-2021 11:14:43.892 +0000 INFO TcpOutputProc - Connected to idx=XXXXXX:9999 using ACK. 02-18-2021 11:14:46.292 +0000 INFO TcpOutputProc - Connected to idx=XXXXXX:9999 using ACK. splunk@:/opt/splunkforwarder/var/log/splunk$
... View more
