Security

changing Splunk admin account to dmoain service account

rajkumarv
Engager

Hi,

Can any one help, is it possible to change the Splunk admin account which is created in the Splunk (at application level) to domain service account?.
This is required for one of the storage requirement. We have a shared drive (SAN) for Indexer cold storage and that storage drive requires user name and password to authenticate. As per the company policy they will provide access to the shared drive only to the domain service account, however the Splunk instances including Index cluster, Search heads, and master node are installed with username created in Splunk. So are not sure whether the Splunk application will get authenticate to storage drive (SAN shared drive) to store the cold data as per the retention policy. So I would like to know whether we can change the Splunk admin account to domain account for managing splunk.

Tags (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

If you are indexer is running as user 'splunk' that user needs 'read/write' access to your SAN storage for hotwarm and cold buckets. If access cannot be provided to 'splunk' account, you can have a 'service/domain account' created and can be used to run your indexer [ and/or other instances of splunk servers running as 'splunk']. This way, you may be able to work with your policy.

Splunk 'admin' account is a special account for administering splunk instances.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...