How to find users who stopped a windows service

[jg91]

How can I find users who stopped a service?
I have tried

[WinHostMon://service]

and

[WinEventLog://System]

But the first option lists the status of services and for second option log doesn't have a User field.

[Roy_9]

below solution might help you 

https://community.splunk.com/t5/Splunk-Search/Looking-for-better-alternative-to-checking-a-windows-s...

[m_zandinia]

It's a good question. If you find out how can find which user have stopped a service please let me know.

Thanks