topic Splunk startup script, start as splunk user in Security

Splunk startup script, start as splunk user

joberget — Wed, 13 Apr 2011 14:50:20 GMT

Hi, I recently installed the new Splunk Universal Forwarder. I use the built-in bootup script that comes with Splunk, however I want Splunk to start as the splunk user and not root. How do I change that? I know I can add su - splunk in front of the "/opt/splunk/bin/splunk" start --no-prompt. What is best practice here?

splunk_start() {
  echo Starting Splunk...
  su - splunk "/opt/splunk/bin/splunk" start --no-prompt
  RETVAL=$?
}

Re: Splunk startup script, start as splunk user

gkanapathy — Wed, 13 Apr 2011 20:56:34 GMT

If you set up the boot script using:

./splunk enable boot-start -user splunk

instead of just

./splunk enable boot-start

the boot script will be created to run as the user specified. I believe that it pretty much just uses su - splunk as above though.

Re: Splunk startup script, start as splunk user

gfriedmann — Wed, 15 Jun 2011 22:37:23 GMT

You also may want to "chown -R splunk:splunk /opt/splunk" while the system is down.