How to find the User ID that was used for the original splunk installation

[jlongworth]

I want to upgrade a system. How do I find the ID for the user that installed it? Is it somewhere in the system?

[PavelP]

Hello @jlongworth

you can find this information in the operating system's logs:

• Windows - eventvwr.msc - installation
• Linux - find the installation date and time in /var/log/yum*log or /var/log/dpgk*log and correlate it with output of last command

you can find it using splunk UI if these logs are indexed by splunk