How to generate a search to find out hosts in Splunkd that have restarted?

[kteng2024]

Can i please know the search to find out the hosts in Splunkd that have restarted or has " splunkd started Conf mutator lockfile has disappeared error " in splunkd_stderr.log on forwarder?

[aaraneta_splunk]

@kteng2024 - Did the answer provided by hunters help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

[hunters_splunk · Accepted solution]

Hi kteng2024,

Here are a couple of searches that may help you:

When did Splunk last crash?

index=_internal sourcetype=splunkd_crash_log | stats count by host

All Splunk restarts based on loader

index=_internal sourcetype=splunkd loader message=*xml

Hope this helps. Thanks!
Hunter