Change Splunk user from root to Splunk user

[Ricco19]

Hi,

The Splunk Heavy Forwarders and Deployment Servers were running under Splunk user. Unfortunately, during the upgrade process, some admin used the root account, and now the these Splunk instances are running as root. How can I switch back to the Splunk user? These instances are running on Red Hat Linux.

[richgalloway]

This is fairly common and easy to correct.

1. Stop Splunk
2. Change the ownership of all Splunk files using the command (as root) chown -r splunk:splunk /opt/splunk
3. Start Splunk