Start a Windows Service

This Splunk Query will return results for any Windows Service that has started.

Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/

sourcetype=WinEventLog:Application EventCode=105 | eval Date=strftime(_time, "%Y/%m/%d") | stats count by Date, SourceName, host | sort - Date | fields - count
Share This:

Leave A Comment?