How can I install the Splunk Forwarder on macOS Sierra as root?

[chris]

Hi,

I would like to set up the forwarder on a couple of Macbooks and I would like to index a couple of the inputs from the Splunk Add-on for Unix and Linux. By default the forwarder is not able to read the bash history of all users since the file belongs to root. Also lsof output is different for the admin user and root. Is there a way to install the Forwarder as root? Or grant it root privileges (I have very limited macOS knowledge).
I tried this:
$SPLUNK_HOME/bin/splunk enable boot-start -user root
which did not work we get the following message when we try to run splunk "com.splunk[ID]: Service exited with abnormal code: 1"

Regards
Chris

[cpetterborg]

have you looked at this answer?:

https://answers.splunk.com/answers/180460/mac-os-yosemite-how-to-start-at-boot-time.html

----- Update by chris

I did stumble accross that answer but did not pay close enough attention. Enabling the boot start works with version 6.6.2 of the agent, but starting as root did not.

I moved com.splunk.plist that is created by running en from /Library/LaunchAgents (which is for the currently logged in user) to /Library/LaunchDaemons (which is for root by default) according to your link or http://www.launchd.info/

It is working now. Thanks

Ps: Rerunning splunk enable boot-start will recreate the file under /Library/LaunchAgents so this is probably not a good idea.

[chris]

I opened a case (528502) with splunk asking for a feature/enhancement. To not ignore the -user root option