Splunk add-on for *nix: Can scripted input rlog.sh be enabled if Splunk user is run as non root user?

[kheli]

Can we enable this scripted input if the user splunk is run as non root user?

Any workaround if we have to run splunk as non root user?

[segu]

Yes that's possible. You have to do two things:

1. Comment the line assertInvokerIsSuperuser in the rlog.sh, so no super-user check is done.
2. Give the user that is running splunk read-access to the audit.log, e.g. /var/log/audit/audit.log in RedHat.