I was able to achieve this by editing the lastlog.sh script that came with the splunk app. Find the if statement that pertains to the OS you are using. in the CMD variable add sudo to it. now edit the sudoers rules list to add a rule to allow splunk user to run the command. ... View more