Monitoring Splunk

Logging of Restart Trigger

TheEggi98
Path Finder

Hi there,

for better visibility i built a dashboard for indexer restarts, this dashboard is based on the _internal index and the /var/log/messages from the indexers themself.

I would like to add the Info how the restart was triggered.
so i can see whether the restart came from the manager (WebUI: Configuration Bundle Actions) or was done via the cli.
Does Splunk log this? If yes where do i find that info?

Thanks in advance!

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

It’s go time — Boston, here we come!

Are you ready to take your Splunk skills to the next level? Get set, because Splunk University is back, and ...