Can any one help me with a shell script which checks a Splunk user's process?

[shivanandbm]

Can any one help me with a shell script which checks a Splunk user's process? If it is not running with Splunk user, we should get an email alert. Our Splunk is running on linux platform

[renjith_nair]

@shivanandbm ,

Simple way is to check the process

#!/bin/bash

if [[ $(ps -u Splunk |grep splunkd|grep -v grep|wc -l) -lt 1 ]]
then
        echo "Splunk is not running, sending an email"
else
        echo "Splunk is running"
fi

OR
If the user who runs the script has execution permission for bin/splunk, then you can use $SPLUNK_HOME/bin/splunk status and check for the message

[shivanandbm]

i want to check the user associated with splunk process.it should run with splunk user. there are many cases splunk has been started with root user.we came to know after several days when all the report generation have been failed.

[renjith_nair]

ps -u Splunk gives you only the processes running with user "Splunk". Try it!

[harsmarvania57]

Hi @shivanandbm,

If you are running Splunk_TA_nix add-on on all your linux servers in that case you can use ps.sh script (sourcetype=ps) to check -p_8089_restart process with username and accordingly you can create schedule search on Splunk based on your requirement to send email alert.

[shivanandbm]

no we are not using that addon. we are thinking it to monitor from the platform itself