check if splunk is installed on linux systems and the process name

[LinkLoop]

i need to run a script to check if a list of linux servers have splunk installed and the process name. any idea what the process name is or the installed directory? and if its forwarding to splunk console?

[richgalloway]

The default installation directory for Splunk Enterprise is /opt/splunk and for the Universal Forwarder it's /opt/splunkforwarder.  Both can be changed during installation so those are not 100% reliable.

The Splunk process name is 'splunkd'.

As for whether it is forwarding to Splunk, that's a bit trickier.  You could issue a splunk list forward-server command, but you'd need execute access on the splunk binary and a Splunk account.

Another option is to use the splunk btool outputs list command to see if there is a server setting.  There may be more than one, however, and zero or more may be in effect.

Consider using network tools to see if splunk has an open connection to port 9997 or 9998.  That's a good test for forwarding.

[LinkLoop]

would windows systems also listen or show connected on these ports?

 port 9997 or 9998

[richgalloway]

They should.