Can any one help me with a shell script which checks a Splunk user's process? If it is not running with Splunk user, we should get an email alert. Our Splunk is running on linux platform
@shivanandbm ,
Simple way is to check the process
#!/bin/bash
if [[ $(ps -u Splunk |grep splunkd|grep -v grep|wc -l) -lt 1 ]]
then
echo "Splunk is not running, sending an email"
else
echo "Splunk is running"
fi
OR
If the user who runs the script has execution permission for bin/splunk, then you can use $SPLUNK_HOME/bin/splunk status
and check for the message
i want to check the user associated with splunk process.it should run with splunk user. there are many cases splunk has been started with root user.we came to know after several days when all the report generation have been failed.
ps -u Splunk
gives you only the processes running with user "Splunk". Try it!
Hi @shivanandbm,
If you are running Splunk_TA_nix
add-on on all your linux servers in that case you can use ps.sh script (sourcetype=ps) to check -p_8089_restart
process with username and accordingly you can create schedule search on Splunk based on your requirement to send email alert.
no we are not using that addon. we are thinking it to monitor from the platform itself