How to change permissions from root to Splunk user?



Need help. Have a client that have been running splunk for a while as root but now whats to run splunk as splunk, and there's no splunk as a user. It's a linux server

Can anyone help with steps to proceed without running into permission error issues

Should I

useradd splunk

chown -R splunk:splunk /opt/splunk

and restart splunk

Will appreciate suggestions


Labels (1)
0 Karma



those are correct steps. Before useradd add also group splunk.

Then in first phase stop splunk on root and then disable boot start.

After you have done crown as a root, enable boot start (preferred way is to use systemd) with user splunk. Check correct command and parameters from docs.

r. Ismo

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...