Splunk Enterprise Security

Splunk Component Reboot/Restart Detected

sunitm
New Member

Hi,

Is there a way to notify if any splunk components were restarted. For Example-Deployment servers, Search heads etc.. were restarted and an user needs to be notified. Thanks in advance.

Regards,
Sunith

0 Karma
1 Solution

ivanreis
Builder

If I understood you question properly, do you want to know when the splunk service(splunkd) is restarted? If so this information is under _audit log
run this query : index=_audit action=restart_splunkd

you can create an alert to be notified when this happen.

View solution in original post

0 Karma

sunitm
New Member

Hello Ivan,

Thanks for your prompt reply. Yes this answers my query.

0 Karma

ivanreis
Builder

If I understood you question properly, do you want to know when the splunk service(splunkd) is restarted? If so this information is under _audit log
run this query : index=_audit action=restart_splunkd

you can create an alert to be notified when this happen.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...