That query is close. Try this
index=_internal sourcetype="splunkd" source=*splunkd.log "shut*"
You also could try searching for component=shutdown
Hi,
i would go with this event in splunkd.log:
"IndexProcessor [5762669 MainThread] - request state change from=RUN to=SHUTDOWN_SIGNALED"
this is triggering Splunk to shutdown..
last events at shutdown looks like this:
10-28-2022 16:35:56.890 +0100 INFO Shutdown [5763136 Shutdown] - shutting down level="ShutdownLevel_Duo2FAHttpClient"
10-28-2022 16:35:56.890 +0100 INFO Shutdown [5763136 Shutdown] - shutting down level="ShutdownLevel_S3ConnectionPoolManager"
10-28-2022 16:35:56.891 +0100 INFO Shutdown [5763136 Shutdown] - shutting down level="ShutdownLevel_WorkloadManager"
10-28-2022 16:35:56.894 +0100 INFO loader [5762669 MainThread] - All pipelines finished
meaning shutdown could be measured with this:
index=_internal sourcetype="splunkd" source=*splunkd.log (request state change from=RUN to=SHUTDOWN_SIGNALED) OR (Shutdown shutting down level=*) | transaction startswith=SHUTDOWN_SIGNALED | table _time duration
best regards,
Andreas