Restarting Splunk in the serverclass.conf


I have question on restarting a Splunk Forwarder when rolling out a new app. In the serverclass.conf file, I'm adding a new app to an existing forwarder. Elsewhere in the serverclass.conf, the forwarder belongs to a server class that contains the restartSplunkd = true statement. When Splunk restarts on the forwarder, what user will it start with? I would like it to restart with a user named splunk, since we have a non-root user running splunk. If I've enabled splunk to restart on boot with a non-root user, will it use that user to start splunk? Any help is greatly appreciated!

Tags (1)
0 Karma


Splunk should restart with the user that you have it configured to run as when you did the install and enabled the boot start.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!