This would show pretty much everything
$SPLUNK_HOME/bin $ ./splunk status | egrep [[:digit:]]+ -o | xargs -I {} lsof -p {}
This would filter out most internal files, network sockets and used libs (although it could filter out also unwanted stuff)
$SPLUNK_HOME/bin $ ./splunk status | egrep [[:digit:]]+ -o | xargs -I {} lsof -p {}
| egrep -v '(TCP|UDP)|\.so| (pipe|anon_inode|socket)|/db/|var/log/splunk/|fishbucket'
This would show pretty much everything
$SPLUNK_HOME/bin $ ./splunk status | egrep [[:digit:]]+ -o | xargs -I {} lsof -p {}
This would filter out most internal files, network sockets and used libs (although it could filter out also unwanted stuff)
$SPLUNK_HOME/bin $ ./splunk status | egrep [[:digit:]]+ -o | xargs -I {} lsof -p {}
| egrep -v '(TCP|UDP)|\.so| (pipe|anon_inode|socket)|/db/|var/log/splunk/|fishbucket'