I had the same error, I fixed it by giving splunk user read access to the  logs and the directory they reside in. ... View more

Yes I confirm, as of today on a CentOS 6 server we tested to modify the shell for splunk user from /bin/bash to /sbin/nologin On this server it is running the Splunk Universal Forwarder. After having modified the /etc/passwd file and restarted the Splunk Universal Forwarder it is still working, as well as the scripts directly launched by it. #to modify the shell usermod -s /sbin/nologin splunk #to restart the Universal Forwarder /etc/init.d/splunk restart   ... View more

For privileged ports, I prefer either a reverse proxy server or an iptables redirect https://www.cyberciti.biz/faq/linux-port-redirection-with-iptables ... View more