Deployment Architecture

Capture the account/user under which splunk services are running on linux

somesoni2
Revered Legend

Is there any way to find out which user/service account is running the splunk services on linux?

I am looking to collect this information from all the forwarders (deployed on servers owned by different teams) to ensure correct service accounts are used to start/restart splunk service.

I did go through the Splunk's internal logs on _internal and _audit index but couldn't find the user reference during a service(splunkd) restart. Any pointer to a linux command/shell script/splunk logs should be helpful.

0 Karma
1 Solution

linu1988
Champion

If you are using Nix app, is it not showing you all the running process details? The user column should show you under which user the splunk forwarder runs.

ps -af|grep "splunkforwarder"

Thanks

View solution in original post

linu1988
Champion

If you are using Nix app, is it not showing you all the running process details? The user column should show you under which user the splunk forwarder runs.

ps -af|grep "splunkforwarder"

Thanks

somesoni2
Revered Legend

We don't run Nix app as its little bit heavy app generating lot of data which we don't need. We use parts of it. Based on your suggestion on ps command, I wrote following command to get required information for Splunk related processes.

ps -C java -o euser,f,comm,args,pid |grep splunk

Thanks

martin_mueller
SplunkTrust
SplunkTrust

I think you'll want -A rather than -a, in case the splunkd process doesn't have a tty associated with it.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...