Could someone please help me with the Splunk query to configure the alert if Forwarder, Indexer, or search head had restart?
@scelikok @soutamo @saravanan90 @thambisetty @ITWhisperer @gcusello @bowesmana @to4kawa
Here is one way, maybe not the best one.
(index=_internal source=*splunkd.log (host=<YOUR SPLUNK NODES>) ((component=CMServiceThread "CMNotifyThread starting eloop") OR (component=ServerConfig "My GUID") OR (component=loader ("All pipelines finished." OR "Shutdown HTTPDispatchThread")) OR (component=ShutdownHandler "Shutting down splunkd")))
| transaction startswith="Shutting down splunkd" endswith="CMNotifyThread starting eloop" keeporphans=true keepevicted=true maxspan=10m
| sort host
| streamstats reset_on_change=t sum(duration) as total_duration by host
| table _time, duration, total_duration, host, _raw
| eval duration=tostring(duration, "duration"), total_duration=tostring(total_duration, "duration")
| sort - _time
View solution in original post