Identification of Splunk Installation Method

[sanjubaba]

How to identify whether the Splunk installation is done by a root or a non-root user on Ubuntu Linux machine?

Can someone specify the command to identify the above requirement?

[isoutamo]

If it's installed with package manager then it's always installed as root. Just enter dpkg -S /opt/splunk/bin/splunk and it tell if that file is installed by package manager.

If it's installed from tar then only way to know that is, if those files have owned by root. Of course ownership of files can be changed later or. Which means that you cannot know that (unless you have audit log) later or.

It you are meaning in which user is running splunk then @renjith_nair's answers shows it.
r. Ismo

[renjith_nair]

You can grep for the splunkd process

ps aux|grep splunkd|grep -v grep

The first column tells you the user owning the process.