We're a startup organization and currently have specific user accounts being used for our 5 different environments. Splunk is planned for installation in Environment 2, and this environment currently has 3 usernames with sudo permissions. Lets call them user1, user2, user3. Would it be possible to install and run Splunk as "user2" rather than the "splunk" user? I'm assuming that this would just involve changing ownership of the $SPLUNK_HOME directory to "user2", followed by sudo user2, and then executing the necessary commands to run/start/stop Splunk?
I found this Splunk doc, but just wanted to confirm that my understanding about installing and running Splunk as a non-Splunk user is correct... https://docs.splunk.com/Documentation/Splunk/8.0.5/Installation/RunSplunkasadifferentornon-rootuser
Hi
yes you can run it which ever user you like eg. user2, srv-splk, splk etc. Just update that user name to correct locations. And remember always check this + do chown -R <user>:<group> $SPLUNK_HOME after you have update splunk version.
Currently it's best to run splunk under systemd services so then you should do start/stop/restart as root or user which has sudo rights.
r. Ismo