Changing the owner of the splunk universal forwarder to a non-root user

Path Finder


We have remote linux servers with universal forwarders already installed by root, we are not admin of these servers and we don't even have a user for us to connect on these servers either. We would like to be able to access the servers as basic users, for instance with a "splunk" user, manage the forwarder configuration and use the splunk command lines (splunk start/restart/btool etc...) with this user, without requiring admin rights.

How can we achieve that ?

I guess we first need the "splunk" user to be created on the servers with a password so that we can at least access the machines.

Then do we just need to change the boot-start configuration and the owner of the forwarder file system ?

/opt/splunk/splunkforwarder/bin/splunk enable boot-start -user splunk
chown -R splunk /opt/splunk/splunkforwarder

 And now we should be able to manipulate the forwarder as we want without admin rights, right ?

We wish we had a spare linux server to test this on but sadly we don't have any means to do this...

Thank you for your help !

Labels (2)
0 Karma


Hi @performancemoni ,

did you already seen this:

I have only one hint for you: before start, check if the splunk user can access all the files to monitor and execute all the scripts you have.



Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...