Splunk Dev

How could i find the reason or cause of indexer down ?

kartm2020
Communicator

I just need to find the reason of indexer down in splunk

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kartm,
it's very difficoult to understand what's happened without any info.
Anyway, start to see Splunk logs ($SPLUNK_HOME/var/log/splunk/splunkd.log or if there's a crash log.
then try to restart Splunk using console so you can see start-up messages and understand if there are error messages.
Ciao.
Giuseppe

0 Karma

soumyasaha25
Contributor

you can start off by looking at splunkd logs (index=_internal source=*splunkd.log) and also look at /var/log/messages and look for events around the time the indexer went down.

0 Karma

kartm2020
Communicator

Thank you. May i know what is the exact error message that comes in splunkd.log? Give me some sample output. it will help me a lot

0 Karma

soumyasaha25
Contributor

it is quite difficult to tell the exact message that splunk will throw when an indexer goes down since it might go down for a variety of factors (maybe the disk/memory/cpu utilization had spiked), but you should be able to figure it out from the splunkd logs just look into the error logs (index=_internal source=*splunkd.log log_level=ERROR host=).

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...