Change Splunk user from root to Splunk user

Ricco19 — Thu, 05 Sep 2024 07:23:20 GMT

Hi,

The Splunk Heavy Forwarders and Deployment Servers were running under Splunk user. Unfortunately, during the upgrade process, some admin used the root account, and now the these Splunk instances are running as root. How can I switch back to the Splunk user? These instances are running on Red Hat Linux.

Re: Change Splunk user from root to Splunk user

richgalloway — Thu, 05 Sep 2024 12:12:56 GMT

This is fairly common and easy to correct.

Stop Splunk
Change the ownership of all Splunk files using the command (as root) chown -r splunk:splunk /opt/splunk
Start Splunk

topic Re: Change Splunk user from root to Splunk user in Getting Data In

Change Splunk user from root to Splunk user

Re: Change Splunk user from root to Splunk user