I Need to create an alert whenever a Linux Server shutdown and whenever a Linux server reboot, can you please help me with query condition, which parameter i need to search to get this alert implemented
PS: We have RHEL,SUSE,Oracle Linux servers in our environment.
Shutdowns may be a problem since it's possible the system could stop before the event is sent to Splunk. Reboots are possible, however. The key is monitoring the right source(s) on your Linux boxes and indexing that data in Splunk. You will need to monitor the /var/log file in which the OS records shutdown and startup events (I don't know which file, ATM). Then it's just a matter of creating a scheduled search to find those events and alert when they're found. Once you have the data in Splunk, come back with questions about searching for it.
--- If this reply helps you, an upvote would be appreciated.