If it's installed with package manager then it's always installed as root. Just enter dpkg -S /opt/splunk/bin/splunk and it tell if that file is installed by package manager.
If it's installed from tar then only way to know that is, if those files have owned by root. Of course ownership of files can be changed later or. Which means that you cannot know that (unless you have audit log) later or.
It you are meaning in which user is running splunk then @renjith_nair
's answers shows it.