https://community.splunk.com/t5/Security/How-to-change-the-user-Splunk-runs-scripts-as/m-p/278253#M7486 <P>We've been using the functionality in Splunk to have it kick off a script when certain search criteria is met. However, we noticed Splunk is executing those scripts as root. How can we change the user it runs scripts as? Note, that Splunk itself is not running from the root user, but a Splunk user.</P> Wed, 10 Feb 2016 16:14:45 GMT Myelin 2016-02-10T16:14:45Z https://community.splunk.com/t5/Security/How-to-change-the-user-Splunk-runs-scripts-as/m-p/278253#M7486 <P>We've been using the functionality in Splunk to have it kick off a script when certain search criteria is met. However, we noticed Splunk is executing those scripts as root. How can we change the user it runs scripts as? Note, that Splunk itself is not running from the root user, but a Splunk user.</P> Wed, 10 Feb 2016 16:14:45 GMT https://community.splunk.com/t5/Security/How-to-change-the-user-Splunk-runs-scripts-as/m-p/278253#M7486 Myelin 2016-02-10T16:14:45Z https://community.splunk.com/t5/Security/How-to-change-the-user-Splunk-runs-scripts-as/m-p/278254#M7487 <P>Splunk should be running scripts as the user which splunkd runs as as far as I am aware - do you have the scripts in the $SPLUNK_HOME/bin/scripts directory? or are they part of a custom app?</P> <P>What sort of scripts are we talking about? Shell, VBS, Powershell?</P> Wed, 10 Feb 2016 16:20:52 GMT https://community.splunk.com/t5/Security/How-to-change-the-user-Splunk-runs-scripts-as/m-p/278254#M7487 LewisWheeler 2016-02-10T16:20:52Z https://community.splunk.com/t5/Security/How-to-change-the-user-Splunk-runs-scripts-as/m-p/278255#M7488 <P>The scripts are in fact in the $SPLUNK_HOME/bin/scripts directory and these are shell scripts.</P> Wed, 10 Feb 2016 16:27:56 GMT https://community.splunk.com/t5/Security/How-to-change-the-user-Splunk-runs-scripts-as/m-p/278255#M7488 Myelin 2016-02-10T16:27:56Z https://community.splunk.com/t5/Security/How-to-change-the-user-Splunk-runs-scripts-as/m-p/278256#M7489 <P>If your scripts run as root then modify your scripts to "<CODE>su - desired_user -c commands</CODE>".</P> <P>There are actually two ways to go about that.</P> <P>If your script is short and has let's say one command in it to run as another user then you could change this:</P> <PRE><CODE>some_command_or_script_to_run </CODE></PRE> <P>to this:</P> <PRE><CODE>su - desired_user -c some_command_or_script_to_run </CODE></PRE> <P>Or if your script is quite long with many different commands in it then you could make a wrapper script that had a line in it like this:</P> <PRE><CODE>su - desired_user -c that_long_script_ with_too_many_lines_to_edit </CODE></PRE> Wed, 10 Feb 2016 17:46:23 GMT https://community.splunk.com/t5/Security/How-to-change-the-user-Splunk-runs-scripts-as/m-p/278256#M7489 lycollicott 2016-02-10T17:46:23Z