Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- How to find stopped service ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- I have windows service called "ess". Due to network glitch the service is entering into stopped state and start state. Since the windows event is generating for delivery network glitch an event is recorded in splunk.
But the service ess is really down, and never entered into running state we need to be alerted.
I want to write splunk to alert only when the service ess went into stopped state but never entered into running state for 25 hosts. Same service is running on 25 hosts and all servers has network glitches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try something below:
index=<indexname> ("ess service")
|transaction host startswith="The ess service entered the stopped state." endswith="The ess service entered the running state." maxspan=30m
|search NOT <field>="The ess service entered the running state."
|table host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try something below:
index=<indexname> ("ess service")
|transaction host startswith="The ess service entered the stopped state." endswith="The ess service entered the running state." maxspan=30m
|search NOT <field>="The ess service entered the running state."
|table host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How long are you prepared to wait for the service to come up again?
- Within 10min, if service is not coming up then need alert.
i.e. an event "The ess service entered into running state" will be logged
Are you looking to alert if all the servers don't come back up within a certain time, or if any one of them doesn't come back up?
Any server out of 25, if the service is not running, then need alert
Are events generated when the service is up, and how regularly do these events occur?
As soon the service started an event will be generated, "The ess Service entered into running state"
Can there be periods when no events are generated but the service is still to be considered up?
No, there will be definitely an event will be generated once the service brought up
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How long are you prepared to wait for the service to come up again? Are you looking to alert if all the servers don't come back up within a certain time, or if any one of them doesn't come back up? Are events generated when the service is up, and how regularly do these events occur? Can there be periods when no events are generated but the service is still to be considered up?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
