Deployment Architecture

Running the Splunk process as a splunk user on Linux, where did you install Splunk?

brent_weaver
Builder

I am installing Splunk as a splunk user. I have it all down, but what directory are people installing it in? Using /opt does not seem like a good idea because you then need to make the /opt dir 775 or 777 depending on who owns /opt...

I welcome to hear where others are installing it. Thanks!

0 Karma

grijhwani
Motivator

You have touched on my biggest gripe with Splunk's system architecture. /opt/splunk is a perfectly valid place to install Splunk, owned by the splunk user. However you should be a superuser to perform the installation. Furthermore - and this is the basis of my objection - you also have to run the entire Splunk instance with root privileges if you want inputs from system logs (unless, of course, you open up the file permissions). Kind of rock/hard place situation.

(You'd think by now Splunk would have broken it down into the main engine and indexes dropping itself down to unprivileged status, and running a micro-service talking through the socket stack purely for accessing privileged logs.)

Here's a typical install

drwxr-xr-x  5 root   root   4096 May  9  2014 /opt
drwxr-xr-x 10 splunk splunk 4096 Jul 13 13:22 /opt/splunk

755 permission, and root ownership on /opt is perfectly normal.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...