INTERESTING. But the call is the issue (cannot do PS calls either). No way to tell the UF system to launch the script locally after a head alert without a UAC override through Splunkd rights elevation? I guess Phantom is it then. Thank you! ... View more

Then WHY does the "c:\program files\SplunkUniversalForwarder\bin\scripts" folder have a README that says, "Scripts placed in this directory can be called by Alerts for execution",? ... View more

By "remote service restart script" do you mean the Restart-Service command from the module Microsoft.PowerShell.Management [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/restart-service?view=powershell-6]? If that's the case then we are headed the right way. We are going to put a script like this in the Universal Forwarder "c:\Program Files\SplunkuniversalFowarder\bin\scripts" folder: (Alert that sets variable) Get-Module -ListAvailable Microsoft*| Select name | Out-String | % {$_ -replace "Name"}|% {$_ -replace "-"}|% {$_ -replace " "} #|out-file -filepath .\ModulesbyName_Microsoft.txt Wait-Event -Timeout 5 Get-Content -Path C:\scripts\ModulesbyName_Microsoft.txt | Import-Module -verbose Wait-Event -Timeout 5.1 return (Restart-Service -name "NameofService" -ErrorAction SilentlyContinue),$? (Splunk script to take alert and fwd to eventlog) -OR- After manual update to PS5.1 Get-Service -Name "PartialNameofService*" | Where-Object {$_.Status -eq "Stopped"} | Restart-Service Get-Service -Name "PartialNameofService*" | Where-Object {$_.Status -eq "Paused"} | Restart-Service -OR- After manual update to PS5 A simple specific command called from Splunk Alert - Other alerts set to watch for EventLog entries Get-Service -Name "PartialNameofService*" | Restart-Service ... View more

Thank you, I will take a look... But specifically I am trying to determine HOW Splunk restarts an application service (NOT a SPLUNK service) from a forwarder. Does it do an RPC call? Does it use Powershell? Does it use the Incoming port 8089? ... View more

This is a question about restarting a service WITH Splunk. ... View more

This is NOT the answer ... View more

NO. How do you USE SPLUNK to restart a service running on a remote server in the network?,I don't want to restart Splunk Enterprise, I want SPLUNK ENTERPRISE to restart a remote service. I want to set an event for a specific app Service, running on a VMWARE 5 Microsoft Windows 2012R2 Guest, we are monitoring with Splunk to restart the application service (Image Gateway) when the logfile shows the service went to sleep (due to fax server comm loss). ... View more