I have used the below search to capture the Splunk service status (Up or Down) via splunkd.log. After an upgrade to the latest version, this search is not working as expected, though we are getting the status update but the datetime field is left blank.
In the older version 6.2.1 we used to get the data in the datetime field. The datetime filed used to display data containing the earliest / latest time stamp of Splunk service status, currently we are not getting it.
Kindly let me know whether we need to modify the below search to fetch the datetime data.
index=_internal host=hp* OR host=vm* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "loader - Splunkd starting" OR "INFO ShutdownHandler - Shutting down splunkd" | eval message=if((message="Shutting down splunkd"),"failure","success") | rename message as status |eval Date_Time= readabledate + " " + readabletime | sort host | table host Date_Time status
Thanks in advance.