Required permission for linux user owner of Splunk software

[SplunkExplorer]

Hi Guys, we have a doubt reagarding the user that execute Splunk on a linux environment.

Until now, we have always avoided use of root user; instead, we have always  installed and configured Splunk on Linux in the following way:

• Create a dedicated user, eg. "splunkuser"
• Change ownership of splunk installation folder to that user
• Configure splunk for boot autorun with dedicated user

What is not clear for us, and we didn't found on doc, is: suppose this user belongs to sudoers group. Here 2 question rise:

1. It can be removed from sudoers, or some Splunk related process require it belong to that group?
2. If it cannot be totally removed from sudoers, which process requires it maintain such kind of privileges?

[gcusello · Accepted solution]

Hi @SplunkExplorer ,

I usually use user splunk and I don't add it to sudoers, but I enabled ACL.

Ciao.

Giuseppe

[SanjayReddy]

Hi @SplunkExplorer 

for your question regarding sudors

I dont think Splunkuser you created , by deafult its not part of any sudors list , it will be group same as splunk user

for running Splunk on linux you dont need to part of any sudors. Splunk perfrom its core funcations as normal.