Getting Data In

Can any one help me with a shell script which checks a Splunk user's process?

shivanandbm
Explorer

Can any one help me with a shell script which checks a Splunk user's process? If it is not running with Splunk user, we should get an email alert. Our Splunk is running on linux platform

Tags (1)
0 Karma

renjith_nair
Legend

@shivanandbm ,

Simple way is to check the process

#!/bin/bash

if [[ $(ps -u Splunk |grep splunkd|grep -v grep|wc -l) -lt 1 ]]
then
        echo "Splunk is not running, sending an email"
else
        echo "Splunk is running"
fi

OR
If the user who runs the script has execution permission for bin/splunk, then you can use $SPLUNK_HOME/bin/splunk status and check for the message

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

shivanandbm
Explorer

i want to check the user associated with splunk process.it should run with splunk user. there are many cases splunk has been started with root user.we came to know after several days when all the report generation have been failed.

0 Karma

renjith_nair
Legend

ps -u Splunk gives you only the processes running with user "Splunk". Try it!

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

harsmarvania57
Ultra Champion

Hi @shivanandbm,

If you are running Splunk_TA_nix add-on on all your linux servers in that case you can use ps.sh script (sourcetype=ps) to check -p_8089_restart process with username and accordingly you can create schedule search on Splunk based on your requirement to send email alert.

0 Karma

shivanandbm
Explorer

no we are not using that addon. we are thinking it to monitor from the platform itself

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...