Installation

Can Splunk be started and run as a non-Splunk user?

adnankhan5133
Communicator

We're a startup organization and currently have specific user accounts being used for our 5 different environments. Splunk is planned for installation in Environment 2, and this environment currently has 3 usernames with sudo permissions. Lets call them user1, user2, user3. Would it be possible to install and run Splunk as "user2" rather than the "splunk" user? I'm assuming that this would just involve changing ownership of the $SPLUNK_HOME directory to "user2", followed by sudo user2, and then executing the necessary commands to run/start/stop Splunk?

I found this Splunk doc, but just wanted to confirm that my understanding about installing and running Splunk as a non-Splunk user is correct... https://docs.splunk.com/Documentation/Splunk/8.0.5/Installation/RunSplunkasadifferentornon-rootuser

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

yes you can run it which ever user you like eg. user2, srv-splk, splk etc. Just update that user name to correct locations. And remember always check this + do chown -R <user>:<group> $SPLUNK_HOME after you have update splunk version.

Currently it's best to run splunk under systemd services so then you should do start/stop/restart as root or user which has sudo rights. 

r. Ismo

Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...