Installation

User permissions for splunk multi-instance installation

dataIngester
Explorer

I know it is possible to have multiple instances of splunk running on the same machine/server.

My question is if there would be a conflict with the $SPLUNK_HOME variable being assigned to the same user "splunk". How can such a configuration be made possible on linux?

I have a Search Head instance installed at /data/splunk/ and the home directory ($SPLUNK_HOME) for the "splunk" user is /data/splunk/bin/.

I need to install a Forwarder on the same machine at /data2/splunkforwarder/ and the user will still be "splunk". 

Will there be no conflict with 2 different home directories being assigned to the same user? Is such an implementation possible?

Labels (2)
0 Karma

manjunathmeti
Champion

For Splunk documentation: https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Splunk-launchconf

SPLUNK_HOME = <string>
* The fully qualified path to the Splunk platform instance installation directory.
* The comment in the auto-generated splunk-launch.conf is informational, not
a live setting, and does not need to be uncommented.
* If not set, the Splunk platform automatically determines the location of SPLUNK_HOME
based on the location of the splunk CLI executable.
* Specifically, the parent of the directory containing splunk or splunk.exe

Accroding to this your forwarder home path will be /data2/splunkforwarder/ if splunk executable exist in /data2/splunkforwarder/bin/

So, there will no conflicts of running two instances under the same user.

 

If this reply helps you, an upvote/like would be appreciated.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...