I am trying to install a new splunk indexer peer in centos 7 (splunk-6.6.5-b119a2a8b0ad-linux-2.6-x86_64.rpm) and I am seeing a big change in startup behavior:
In centos 6, if I run /opt/splunk/bin/splunk start|stop as root, splunk eventually drops privileges and runs as user splunk.
No such thing happens in centos 7, if I run /opt/splunk/bin/splunk start|stop as root, splunk continues to run as user root.
Support tells me splunk is supposed to be started as user splunk, but this is not the case in centos 6. In centos 6 the init.d script does not appear to su to user splunk before it starts splunk.
Is this the expected behavior?
