Hello @SamHTexas ,
To see who restarted Splunk, please run the search
index=_internal sourcetype=splunkd "Received shutdown signal." | ...rest of your query with required fields...
Hope this helps,
S
*** If this helped, please accept it as a solution. It helps others to find the solution more quickly ***
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
