How to see all open files,pipes,network socket open by splunk on Linux?

[abonuccelli_spl]

I'd like to see any file open or also network sockets for the splunkd(including forked processes) and splunkweb.

[abonuccelli_spl · Accepted solution]

This would show pretty much everything

$SPLUNK_HOME/bin $ ./splunk status | egrep [[:digit:]]+ -o | xargs -I {} lsof -p {} 

This would filter out most internal files, network sockets and used libs (although it could filter out also unwanted stuff)

 $SPLUNK_HOME/bin $ ./splunk status | egrep [[:digit:]]+ -o | xargs -I {} lsof -p {} 
    | egrep -v '(TCP|UDP)|\.so| (pipe|anon_inode|socket)|/db/|var/log/splunk/|fishbucket'