We're seeing similar problems.
In splunkforwarder rpm PREIN scriplet they create a splunk group and a unix account. To do so they use /usr/sbin/groupadd and
/usr/sbin/useradd. But splunkforwarder rpm doesn't list these utilities (or rpm which provide them) in dependencies. As a result of the missing dependency splunkforwarder is installed before shadow-utils rpm (which on RHEL provides useradd and groupadd) during RHEL7 installation (when we install RHEL7.2 OS and applications rpms at the same time) and splunk account cannot be created.
These are error messages from anaconda packaging.log:
10:21:36,425 INFO packaging: splunkforwarder-6.4.0-f2c836328108.x86_64 (344/643)
10:21:36,425 INFO packaging: warning: splunkforwarder-6.4.0-f2c836328108.x86_64: Header V4 DSA/SHA1 Signature, key ID 653fb112: NO KEY
10:21:36,425 INFO packaging: /var/tmp/rpm-tmp.Eoswvi: line 30: /usr/sbin/groupadd: No such file or directory
10:21:36,425 INFO packaging: /var/tmp/rpm-tmp.Eoswvi: line 35: /usr/sbin/useradd: No such file or directory
10:21:36,425 INFO packaging: warning: user splunk does not exist - using root
10:21:36,426 INFO packaging: warning: group splunk does not exist - using root
10:21:36,426 INFO packaging: warning: user splunk does not exist - using root
10:21:36,426 INFO packaging: warning: group splunk does not exist - using root
... View more