How to change permissions from root to Splunk user?

[So76]

Hey,

Need help. Have a client that have been running splunk for a while as root but now whats to run splunk as splunk, and there's no splunk as a user. It's a linux server

Can anyone help with steps to proceed without running into permission error issues

Should I

useradd splunk

chown -R splunk:splunk /opt/splunk

and restart splunk

Will appreciate suggestions

[isoutamo]

Hi

those are correct steps. Before useradd add also group splunk.

Then in first phase stop splunk on root and then disable boot start.

After you have done crown as a root, enable boot start (preferred way is to use systemd) with user splunk. Check correct command and parameters from docs.

r. Ismo