I am trying to identify the user or process responsible for stopping the Splunk UF agent. What log source do I require to be able to see this. I have unsuccessfully tried: Searching in internal index - You can only see the service going down.  index=_internal sourcetype=splunkd host="DC*" component=Shutdown* Monitoring the windows system event log for forwarder shutdown event (EventCode 7036 ) No visibility on who performed the action. Looking for ideas on how this can be achieve from Splunk. ... View more