https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Component-Reboot-Restart-Detected/m-p/463959#M6815 <P>If I understood you question properly, do you want to know when the splunk service(splunkd) is restarted? If so this information is under _audit log<BR /> run this query : index=_audit action=restart_splunkd </P> <P>you can create an alert to be notified when this happen.</P> Wed, 30 Sep 2020 02:40:52 GMT ivanreis 2020-09-30T02:40:52Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Component-Reboot-Restart-Detected/m-p/463958#M6814 <P>Hi,</P> <P>Is there a way to notify if any splunk components were restarted. For Example-Deployment servers, Search heads etc.. were restarted and an user needs to be notified. Thanks in advance.</P> <P>Regards,<BR /> Sunith</P> Mon, 21 Oct 2019 13:29:52 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Component-Reboot-Restart-Detected/m-p/463958#M6814 sunitm 2019-10-21T13:29:52Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Component-Reboot-Restart-Detected/m-p/463959#M6815 <P>If I understood you question properly, do you want to know when the splunk service(splunkd) is restarted? If so this information is under _audit log<BR /> run this query : index=_audit action=restart_splunkd </P> <P>you can create an alert to be notified when this happen.</P> Wed, 30 Sep 2020 02:40:52 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Component-Reboot-Restart-Detected/m-p/463959#M6815 ivanreis 2020-09-30T02:40:52Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Component-Reboot-Restart-Detected/m-p/463960#M6816 <P>Hello Ivan,</P> <P>Thanks for your prompt reply. Yes this answers my query.</P> Wed, 23 Oct 2019 09:11:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Component-Reboot-Restart-Detected/m-p/463960#M6816 sunitm 2019-10-23T09:11:24Z