Hey,
Need help. Have a client that have been running splunk for a while as root but now whats to run splunk as splunk, and there's no splunk as a user. It's a linux server
Can anyone help with steps to proceed without running into permission error issues
Should I
useradd splunk
chown -R splunk:splunk /opt/splunk
and restart splunk
Will appreciate suggestions
Hi
those are correct steps. Before useradd add also group splunk.
Then in first phase stop splunk on root and then disable boot start.
After you have done crown as a root, enable boot start (preferred way is to use systemd) with user splunk. Check correct command and parameters from docs.
r. Ismo