Installation

Can Splunk be started and run as a non-Splunk user?

adnankhan5133
Communicator

We're a startup organization and currently have specific user accounts being used for our 5 different environments. Splunk is planned for installation in Environment 2, and this environment currently has 3 usernames with sudo permissions. Lets call them user1, user2, user3. Would it be possible to install and run Splunk as "user2" rather than the "splunk" user? I'm assuming that this would just involve changing ownership of the $SPLUNK_HOME directory to "user2", followed by sudo user2, and then executing the necessary commands to run/start/stop Splunk?

I found this Splunk doc, but just wanted to confirm that my understanding about installing and running Splunk as a non-Splunk user is correct... https://docs.splunk.com/Documentation/Splunk/8.0.5/Installation/RunSplunkasadifferentornon-rootuser

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

yes you can run it which ever user you like eg. user2, srv-splk, splk etc. Just update that user name to correct locations. And remember always check this + do chown -R <user>:<group> $SPLUNK_HOME after you have update splunk version.

Currently it's best to run splunk under systemd services so then you should do start/stop/restart as root or user which has sudo rights. 

r. Ismo

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...