topic Re: Can any one help me with a shell script which checks a Splunk user's process? in Getting Data In

Can any one help me with a shell script which checks a Splunk user's process?

shivanandbm — Tue, 02 Oct 2018 12:06:46 GMT

Can any one help me with a shell script which checks a Splunk user's process? If it is not running with Splunk user, we should get an email alert. Our Splunk is running on linux platform

Re: Can any one help me with a shell script which checks a Splunk user's process?

harsmarvania57 — Tue, 02 Oct 2018 12:50:41 GMT

Hi @shivanandbm,

If you are running Splunk_TA_nix add-on on all your linux servers in that case you can use ps.sh script (sourcetype=ps) to check -p_8089_restart process with username and accordingly you can create schedule search on Splunk based on your requirement to send email alert.

Re: Can any one help me with a shell script which checks a Splunk user's process?

shivanandbm — Wed, 03 Oct 2018 06:29:29 GMT

no we are not using that addon. we are thinking it to monitor from the platform itself

Re: Can any one help me with a shell script which checks a Splunk user's process?

renjith_nair — Wed, 03 Oct 2018 18:33:01 GMT

@shivanandbm ,

Simple way is to check the process

#!/bin/bash

if [[ $(ps -u Splunk |grep splunkd|grep -v grep|wc -l) -lt 1 ]]
then
        echo "Splunk is not running, sending an email"
else
        echo "Splunk is running"
fi

OR
If the user who runs the script has execution permission for bin/splunk, then you can use $SPLUNK_HOME/bin/splunk status and check for the message

Re: Can any one help me with a shell script which checks a Splunk user's process?

shivanandbm — Thu, 04 Oct 2018 07:21:30 GMT

i want to check the user associated with splunk process.it should run with splunk user. there are many cases splunk has been started with root user.we came to know after several days when all the report generation have been failed.

Re: Can any one help me with a shell script which checks a Splunk user's process?

renjith_nair — Fri, 05 Oct 2018 20:57:40 GMT

ps -u Splunk gives you only the processes running with user "Splunk". Try it!