IIS --- it starts automatically at every reboot. So there is no specific eventlog entry for it starting.
I'd like to monitor (thru Splunk) BOTH/EITHER of these conditions:
--- an IISRESET command that stops/starts the IIS service
--- in lieu of that, the previous reboot time as the "start" time of the service
Having a "most recent" time of BEFORE a reboot (via eventlog entries) is worthless to me...
