changing Splunk admin account to dmoain service account



Can any one help, is it possible to change the Splunk admin account which is created in the Splunk (at application level) to domain service account?.
This is required for one of the storage requirement. We have a shared drive (SAN) for Indexer cold storage and that storage drive requires user name and password to authenticate. As per the company policy they will provide access to the shared drive only to the domain service account, however the Splunk instances including Index cluster, Search heads, and master node are installed with username created in Splunk. So are not sure whether the Splunk application will get authenticate to storage drive (SAN shared drive) to store the cold data as per the retention policy. So I would like to know whether we can change the Splunk admin account to domain account for managing splunk.

Tags (1)
0 Karma


If you are indexer is running as user 'splunk' that user needs 'read/write' access to your SAN storage for hotwarm and cold buckets. If access cannot be provided to 'splunk' account, you can have a 'service/domain account' created and can be used to run your indexer [ and/or other instances of splunk servers running as 'splunk']. This way, you may be able to work with your policy.

Splunk 'admin' account is a special account for administering splunk instances.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...