I have question on restarting a Splunk Forwarder when rolling out a new app. In the serverclass.conf file, I'm adding a new app to an existing forwarder. Elsewhere in the serverclass.conf, the forwarder belongs to a server class that contains the restartSplunkd = true statement. When Splunk restarts on the forwarder, what user will it start with? I would like it to restart with a user named splunk, since we have a non-root user running splunk. If I've enabled splunk to restart on boot with a non-root user, will it use that user to start splunk? Any help is greatly appreciated!
