It's not entirely clear to me whether you want to actually run splunk as a non-privileged user, or if you want to run it as root but be able to manage the install while being logged in as a non-privileged user.
If it's that you want to run it as a non-privileged user, that's very easy to do, but no, you cannot then listen on privileged ports or read files which that user doesn't have privileges to read. There's really no way around that that I know of. For instance, when you instruct Splunk to listen for syslog traffic, it's the splunkd process that is doing the listening, evident by the following:
$ sudo lsof -i UDP:8514
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
splunkd 81284 mw 33u IPv4 0x0881a2e8 0t0 UDP *:8514
In the above, I'm explicitly not using a privileged port because I'm not running Splunk as root, but you can see the command which is listening on the port is splunkd. So, in order to use port 514 splunkd needs to be running as root. In order to read some logfiles splunkd would need to be running as root as well. Running splunkd as root and "Starting Splunk" as root are effectively identical statements.
So, you need to make a decision. Do you require the ability to listen to privileged ports and read "privileged" files? If so, then you must run Splunk as a privileged user.
If you want to run Splunk as root, but manage it as another user, that can mostly be done by giving your user sudo access to the "splunk" command (i.e. /opt/splunk/bin/splunk). However, that's really only going to give you management over a reasonable bit of functionality, but you'll probably find that there's a class of things that you'd like to do which either can't be done through that command or would be more easily done by directly editing config files, etc.
Some software would provide a separate setuid process that would do privileged things, so that you could run the solution as a non-privileged user, but still have privileged capabilities for very specific items. In other words, splunkd could run as the user "splunk" and would spawn a setuid process called, for instance, "syslog_listener" which would run as root and have the ability to listen on privileged ports. I can't speak to the security issues with that or why Splunk isn't architected with that in mind.
... View more
