How to upgrade splunk RPM and keep splunk user file permissions?

[gfriedmann]

I am using the RPM package for splunk. I also utilize the "run splunk as splunk user" option.

But there is a problem. I have to install an RPM as root. When i upgrade using the RPM, it stops splunk, upgrades the files, and then restarts splunk as root. After this, the file permissions are all messed up, with newly created files being owned by root.

How do others deal with this? Might it be fine to upgrade an RPM install using the .tgz package?

[gfriedmann]

Actually, splunk upgrade doesn't auto-start splunk as root.

After running

sudo rpm -U splunk-4.2.2...rpm

Then start splunk as the splunk user like this

 sudo su - splunk -c "splunk start --answer-yes --accept-license --no-prompt"