Splunk Enterprise Security

Splunk Component Reboot/Restart Detected

sunitm
New Member

Hi,

Is there a way to notify if any splunk components were restarted. For Example-Deployment servers, Search heads etc.. were restarted and an user needs to be notified. Thanks in advance.

Regards,
Sunith

0 Karma
1 Solution

ivanreis
Builder

If I understood you question properly, do you want to know when the splunk service(splunkd) is restarted? If so this information is under _audit log
run this query : index=_audit action=restart_splunkd

you can create an alert to be notified when this happen.

View solution in original post

0 Karma

sunitm
New Member

Hello Ivan,

Thanks for your prompt reply. Yes this answers my query.

0 Karma

ivanreis
Builder

If I understood you question properly, do you want to know when the splunk service(splunkd) is restarted? If so this information is under _audit log
run this query : index=_audit action=restart_splunkd

you can create an alert to be notified when this happen.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!