Hi there,
for better visibility i built a dashboard for indexer restarts, this dashboard is based on the _internal index and the /var/log/messages from the indexers themself.
I would like to add the Info how the restart was triggered.
so i can see whether the restart came from the manager (WebUI: Configuration Bundle Actions) or was done via the cli.
Does Splunk log this? If yes where do i find that info?
Thanks in advance!
