Getting Data In

Can any one help me with a shell script which checks a Splunk user's process?

shivanandbm
Explorer

Can any one help me with a shell script which checks a Splunk user's process? If it is not running with Splunk user, we should get an email alert. Our Splunk is running on linux platform

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@shivanandbm ,

Simple way is to check the process

#!/bin/bash

if [[ $(ps -u Splunk |grep splunkd|grep -v grep|wc -l) -lt 1 ]]
then
        echo "Splunk is not running, sending an email"
else
        echo "Splunk is running"
fi

OR
If the user who runs the script has execution permission for bin/splunk, then you can use $SPLUNK_HOME/bin/splunk status and check for the message

Happy Splunking!
0 Karma

shivanandbm
Explorer

i want to check the user associated with splunk process.it should run with splunk user. there are many cases splunk has been started with root user.we came to know after several days when all the report generation have been failed.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

ps -u Splunk gives you only the processes running with user "Splunk". Try it!

Happy Splunking!
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @shivanandbm,

If you are running Splunk_TA_nix add-on on all your linux servers in that case you can use ps.sh script (sourcetype=ps) to check -p_8089_restart process with username and accordingly you can create schedule search on Splunk based on your requirement to send email alert.

0 Karma

shivanandbm
Explorer

no we are not using that addon. we are thinking it to monitor from the platform itself

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...