Shutdowns may be a problem since it's possible the system could stop before the event is sent to Splunk. Reboots are possible, however. The key is monitoring the right source(s) on your Linux boxes and indexing that data in Splunk. You will need to monitor the /var/log file in which the OS records shutdown and startup events (I don't know which file, ATM). Then it's just a matter of creating a scheduled search to find those events and alert when they're found. Once you have the data in Splunk, come back with questions about searching for it.
---
If this reply helps you, Karma would be appreciated.
