Deployment Architecture

Identification of Splunk Installation Method

Path Finder

How to identify whether the Splunk installation is done by a root or a non-root user on Ubuntu Linux machine?

Can someone specify the command to identify the above requirement?

0 Karma

If it's installed with package manager then it's always installed as root. Just enter dpkg -S /opt/splunk/bin/splunk and it tell if that file is installed by package manager.

If it's installed from tar then only way to know that is, if those files have owned by root. Of course ownership of files can be changed later or. Which means that you cannot know that (unless you have audit log) later or.

It you are meaning in which user is running splunk then @renjith_nair's answers shows it.
r. Ismo
0 Karma


You can grep for the splunkd process

ps aux|grep splunkd|grep -v grep

The first column tells you the user owning the process.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...