Splunk query for Forwarder , Indexer & SH restart

[alexspunkshell]

Could someone please help me with the Splunk query to configure the alert if Forwarder, Indexer, or search head had restart?

@scelikok @soutamo @saravanan90 @thambisetty @ITWhisperer @gcusello @bowesmana   @to4kawa 

[isoutamo · Accepted solution]

Hi

Here is one way, maybe not the best one.

(index=_internal source=*splunkd.log (host=<YOUR SPLUNK NODES>) ((component=CMServiceThread "CMNotifyThread starting eloop") OR (component=ServerConfig "My GUID") OR (component=loader ("All pipelines finished." OR "Shutdown HTTPDispatchThread")) OR (component=ShutdownHandler "Shutting down splunkd"))) 
| transaction startswith="Shutting down splunkd" endswith="CMNotifyThread starting eloop" keeporphans=true keepevicted=true maxspan=10m
| sort host 
| streamstats reset_on_change=t sum(duration) as total_duration by host
| table _time, duration, total_duration, host, _raw
| eval duration=tostring(duration, "duration"), total_duration=tostring(total_duration, "duration")
| sort - _time

r. Ismo