Run Splunk Enterprise as a different or non-root user
Important: This topic is for non-Windows operating systems only.
- To configure Splunk software to run at boot time as a non-root user, see Enable boot-start as a non-root user.
- To learn how to install Splunk Enterprise on Windows using a user that is not an administrator, see Choose the user Splunk Enterprise should run as.
- To learn how to change the Windows user that Splunk Enterprise services use, see Change the user selected during Windows installation.
You can run Splunk Enterprise as any user on the local system. It is a Splunk best practice to run Splunk software as a non-root user.
If you run Splunk software as a non-root user, confirm that it can:
- Read the files and directories that you configure it to monitor. Some log files and directories might require root or superuser access to be indexed.
- Write to the Splunk Enterprise directory and execute any scripts configured to work with your alerts or scripted input.
- Bind to the network ports it is listening on. Network ports below 1024 are reserved ports that only the root user can bind to.
Because network ports below 1024 are reserved for root access only, Splunk software can only listen on port 514 (the default listening port for syslog) if it runs as root. You can, however, install another utility (such as syslog-ng) to write your syslog data to a file and have Splunk monitor that file instead.
Set up Splunk software to run as a non-root user
- Install Splunk software as the root user, if you have root access. Otherwise, install the software into a directory that has write access for the user that you want Splunk software to run as.
- Change the ownership of the
$SPLUNK_HOMEdirectory to the user that you want Splunk software to run as.
- Start the Splunk software.
Example instructions on how to install Splunk software as a non-root user
In this procedure,
$SPLUNK_HOME represents the path to the Splunk Enterprise installation directory.
- Log into the machine that you want to install Splunk software as root.
- Create the
splunkuser and group.
On Linux, Solaris, and FreeBSD:
useradd splunk groupadd splunk
On Mac OS: You can use the System Preferences > Accounts System Preferences panel to add users and groups.
- Install the Splunk software, as described in [Chooseyourplatform|Installation instructions].
Do not start Splunk Enterprise yet.
- Run the
chowncommand to change the ownership of the
splunkdirectory and everything under it to the user that you want to run the software.
chown -R splunk:splunk $SPLUNK_HOME
If the 'chown' binary on your system does not support changing group ownership of files, you can use the 'chgrp' command instead. See the 'man' pages on your system for additional information on changing group ownership.
- Become the non-root user.
su - <user>
You can also log out of the root account and log in as that user
- Start the Splunk software.
Use sudo to start or stop Splunk software as a different user
If you want to start Splunk Enterprise as the
splunk user while you are logged in as a different user, you can use the
sudo -H -u splunk $SPLUNK_HOME/bin/splunk start sudo -H -u splunk $SPLUNK_HOME/bin/splunk stop
This example command assumes the following:
- That Splunk Enterprise has been installed in the default installation directory. If Splunk Enterprise is in an alternate location, update the path in the command accordingly.
- That your system has the
sudocommand available. If this is not the case, use
suor get and install
- That you have already created the user that you want Splunk software to run as.
- That the
splunkuser has access to the
/dev/urandomdevice to generate the certificates for the product.
Additional privileges and network ports required for installation on Solaris 10
When installing Splunk Enterprise on Solaris 10 as the
splunk user, you must set additional privileges to start
splunkd and bind to reserved ports.
splunkd as the
splunk user on Solaris 10, run:
usermod -K defaultpriv=basic,net_privaddr,proc_exec,proc_fork splunk
To allow the
splunk user to bind to reserved ports on Solaris 10, run (as root):
usermod -K defaultpriv=basic,net_privaddr splunk
Install the universal forwarder on HP-UX
Start Splunk Enterprise for the first time
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12