In my project environment, every splunkd is installed using splunk user. So I need to create an alert if any splunkd on any splunk server (enterprise or UF) gets started with root or any other user post boot or if anyone starts it with any other user than splunk.
you could create a script that runs the ps command (e.g. in Linux) on the system to monitor, then Forwarder send results to Splunk and you can analyze the result.
If you want, you can also use the script in Splunk_TA-nix.
you could create a script that runs the ps command (e.g. in Linux) on the system to monitor, then Forwarder send results to Splunk and you can analyze the result.
If you want, you can also use the script in Splunk_TA-nix.
