Changing Splunkd Windows Service Account

[hjmiii]

In the docs under "Correct the user selected during Windows installation" it states:

"you can go into the Windows Service
Control Manager and specify the
correct information, as long as you
have not started Splunk yet. If you
have started Splunk, you must stop it,
uninstall it and reinstall it."

Can anyone elaborate on why you'd have to reinstall? Does the account get embedded in the configs somewhere in addition to the windows service? I have an install that was done months ago using the local system account, and I'd like to change it to use a domain account. Assigning all the needed permissions and rights shouldn't be a problem.

[robhorton · Accepted solution]

You shouldn't have any issues changing the account that the service is running as. As long as that user has the right to logon as a service, which windows will take care of when you assign the account to the service, you won't have any issues. I installed my system and then switched the service to run using a domain account when WMI did not work and have not had any issues at all. Also, I'm using the built-in Splunk security and it has not thrown any errors when changing the configuration, which would happen if the service account did not have the ability to write to files in the Splunk installation directory.

[gkanapathy]

You don't really, but you'd have to change ownership possibly permissions all of the installed files. There is a mix of read/read-write/read only by owner, etc. permissions on various installed files, and others on files that are generated on first-time run, and others as configuration and initial directories for data. So it might be easier to reinstall. Now, you actually could just change the ownership on all of them. Though really, a default installation has everything under c:\Programs\Splunk, so you could just cascade the ownership change down from there and it should be fine.