Thanks, I tried this and it worked.  For those who are curious as to what I ended up doing on the server to get it running as 'splunk' with systemd and monitoring own files:     user@splunkserver:~$ sudo apt install splunk user@splunkserver:~$ sudo /opt/splunk/bin/splunk start --accept-license This appears to be your first time running this version of Splunk. ... user@splunkhost:~$ sudo gpasswd -a splunk adm # let splunk read the logs user@splunkhost:~$ sudo /opt/splunk/bin/splunk stop user@splunkhost:~$ sudo chown -R splunk:splunk /opt/splunk user@splunkhost:~$ sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 1 user@splunkhost:~$ sudo systemctl enable --now Splunkd user@splunkhost:~$ sudo -u splunk /opt/splunk/bin/splunk enable listen 9997 user@splunkhost:~$ sudo -u splunk /opt/splunk/bin/splunk add monitor /var/log/audit/audit.log -index main -sourcetype audit-log user@splunkhost:~$ sudo -u splunk /opt/splunk/bin/splunk add monitor /var/log/auth.log -index main -sourcetype auth-log       On the other nodes I installed the universal forwarder as normal (which runs as 'splunk' by default):       user@client:~$ sudo apt install splunkforwarder user@client:~$ sudo /opt/splunkforwarder/bin/splunk enable boot-start -systemd-managed 1 --accept-license This appears to be your first time running this version of Splunk. user@client:~$ sudo gpasswd -a splunk adm # allow splunk to read the logs user@client:~$ sudo systemctl enable --now SplunkForwarder user@client:~$ sudo -u splunk /opt/splunkforwarder/bin/splunk add forward-server splunkserver:9997 user@client:~$ sudo -u splunk /opt/splunkforwarder/bin/splunk list forward-server user@client:~$ sudo -u splunk /opt/splunkforwarder/bin/splunk add monitor /var/log/audit/audit.log -index main -sourcetype audit-log user@client:~$ sudo -u splunk /opt/splunkforwarder/bin/splunk add monitor /var/log/auth.log -index main -sourcetype auth-log      As for the % sigil in the source labels I got that from this link but I have since removed them:  Solved: How do I configure a Splunk Forwarder on Linux? - Splunk Community I may look into using the Add-on For UNIX and Linux but honestly this was pretty simple and meets my immediate needs.  Thanks for the help! ... View more

You would think, but our sudo maps are centrally stored in LDAP and heavily locked down for all manner of shell escapes and subshelling.  I'd blame the admin but I am one of them! ... View more

Thanks.  I am actually not running Splunk as root (it runs as Splunk) but I can't log in as that user.  I could probably get around it using sudo /usr/sbin/runuser -s /bin/bash splunk so I can run those commands as the proper user.  Perhaps running those as root created files Splunk couldn't read.  I'll give it a try, report back, and give you the upvote once I can verify.  Thanks again! ... View more