Installing rpm as different user and not creating splunk user

[aaronkorn]

Is it possible to install the universal forwarder rpm as a different user and not have the rpm create the "splunk" user?

[dart · Accepted solution]

In this scenario I'd usually use the tarball to install Splunk

Does that option work for you?

[aaronkorn]

Thank you both for your contributions. This will work for me.

[kristian_kolb]

Hm, I guess it would be possible to:

a) install the rpm
b) chown all files in /opt/splunkforwarder
c) delete the 'splunk' user account
d) create the init.d script to run splunk with the user of your choice.

However, I have not tried this, and I'm also unsure if it would survive an upgrade.

Or if you download the tgz instead of rpm, it won't create any accounts, AFAIK.

/Kristian