Configure Hunk to run reports as a different user
|This feature has been deprecated.|
|This feature has been deprecated as of Hunk version 6.2.1. This means that although it continues to function, it might be removed in a future version.|
By default, Hunk runs and spawns MapReduce jobs as the OS user used to install and run the search head server. If you install a Hunk license on an existing Splunk installation that has already been configured, or if your MapReduce user changes, you may need to reconfigure your Hunk user in order to run MapReduce jobs.
To run MapReduce jobs as a different user, you spawn the Splunk MapReduce process in the search head as that user. To do this you:
- Give your MapReduce user permissions to Splunk.
- Assign your MapReduce user as the Hunk user.
We do the rest by providing a script that changes the user before running the ERP process
Reconfigure your user for Hunk:
Note: For this process to be effective, your
vix.splunk.setup.package should be set to an absolute path to the Hunk binary file.
1. Create a *nix user on the machine your search head resides on and give it the name of the user you want to use to run MapReduce jobs. For this example, let's call this *nix user "NewUser". Make sure "NewUser" has permissions to write to
2. Set the
umask for the *nix account that was originally used to install Splunk. For this example, let's call this original user "SplunkUser".
umask [-S ] [SplunkUser]
This makes the files created by "SplunkUser" readable to the "NewUser" *nix user account you just created. If you want to learn more about the
umask command, check out the following article: http://en.wikipedia.org/wiki/Umask.
3. Set Splunk's internal
launch.conf so that files Splunk creates are readable to NewUser:
Example : SPLUNKD_MINIMUM_UMASK=0002
4. Give "SplunkUser" Passwordless sudo permissions, so they can run as "NewUser" for bin bash by adding the following line via
SplunkUser ALL=(NewUser) NOPASSWD: /bin/bash
requiretty for "SplunkUser". Use
visudo to add the following line (if you do not do this, the virtual index search will return something like this: "sudo: sorry, you must have a tty to run sudo.")
indexes.conf to tell Hunk to run MapReduce jobs as "NewUser". This can be updated in the provider or the virtual index stanza.
7. Make sure the following are executable by both "SplunkUser" and "NewUser":
hadoopscript in your
Hadoop CLIscript in your
$HADOOP_HOMEdirectory is executable.
- Any Splunk jars in the "NewUser" home directory must also be executable by "SplunkUser".
- Any Splunk jars in the "HunkUser" home directory, must be executable by "NewUser".
8. Restart Hunk to propagate your changes.
Configure pass-through authentication in the configuration file
About archiving Splunk indexes
This documentation applies to the following versions of Hunk®(Legacy): 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13