https://community.splunk.com/t5/Getting-Data-In/Windows-Services-reboot-OR-service-action/m-p/502766#M85638 <P>IIS --- it starts automatically at every reboot. So there is no specific eventlog entry for it starting.<BR /> I'd like to monitor (thru Splunk) <STRONG>BOTH/EITHER</STRONG> of these conditions:<BR /> --- an IISRESET command that stops/starts the IIS service<BR /> --- in lieu of that, the previous reboot time as the "start" time of the service</P> <P>Having a "most recent" time of BEFORE a reboot (via eventlog entries) is worthless to me... </P> Mon, 09 Dec 2019 17:48:02 GMT markhelotie 2019-12-09T17:48:02Z https://community.splunk.com/t5/Getting-Data-In/Windows-Services-reboot-OR-service-action/m-p/502766#M85638 <P>IIS --- it starts automatically at every reboot. So there is no specific eventlog entry for it starting.<BR /> I'd like to monitor (thru Splunk) <STRONG>BOTH/EITHER</STRONG> of these conditions:<BR /> --- an IISRESET command that stops/starts the IIS service<BR /> --- in lieu of that, the previous reboot time as the "start" time of the service</P> <P>Having a "most recent" time of BEFORE a reboot (via eventlog entries) is worthless to me... </P> Mon, 09 Dec 2019 17:48:02 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Services-reboot-OR-service-action/m-p/502766#M85638 markhelotie 2019-12-09T17:48:02Z