Deployment Architecture

Identification of Splunk Installation Method

Path Finder

How to identify whether the Splunk installation is done by a root or a non-root user on Ubuntu Linux machine?

Can someone specify the command to identify the above requirement?

0 Karma

If it's installed with package manager then it's always installed as root. Just enter dpkg -S /opt/splunk/bin/splunk and it tell if that file is installed by package manager.

If it's installed from tar then only way to know that is, if those files have owned by root. Of course ownership of files can be changed later or. Which means that you cannot know that (unless you have audit log) later or.

It you are meaning in which user is running splunk then @renjith_nair's answers shows it.
r. Ismo
0 Karma


You can grep for the splunkd process

ps aux|grep splunkd|grep -v grep

The first column tells you the user owning the process.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...