Splunk® Light (Legacy)

Installation Manual

Acrobat logo Download manual as PDF

On October 22, 2021, Splunk Light will reach its end of life. After this date, Splunk will no longer maintain or develop this product.
Acrobat logo Download topic as PDF

Run Splunk Light as a non-root user

You can run Splunk Light as any user on the local system that has the appropriate permissions.

  • Read the files and directories that it is configured to monitor or index. Some files and directories require root or superuser access to be indexed.
  • Write to the Splunk Light directory and execute any scripts that are configured to work with your alerts of scripted inputs.
  • Bind to the network ports it monitors. Network ports below 1024 are reserved ports that only the root user can bind to.

On Windows

When you run the Windows installer for Splunk Light, you can select the user to run. The user that you select determines what data Splunk Light can monitor. The Local System user can access all data on the local machine, but nothing else. To run as other existing users, you need to define their access before you install Splunk Light.

You must install as a domain user to do any of the following actions.

  • Read Event Logs remotely.
  • Collect performance counters remotely.
  • Read network shares for log files.
  • Monitor Active Directory.

On Mac OSX and Linux

Follow these steps to run Splunk Light as a non-root user called splunkuser.

1. As the root user, create the user and group splunk.

  • On Mac OSX, use the System Preferences > Accounts panels to create the user splunkuser and group splunk.
  • On Linux, run the following commands:
useradd splunkuser
groupadd splunk

Note: The splunkuser requires access to /dev/urandom to generate the certs for the product.

2. As the root user, install Splunk Light using one of the packages that is not a tar file.

Note: After the installation finishes, do not start Splunk Light.

3. Change the ownership of the $SPLUNK_HOME directory and its contents to the splunk user.

chown -R splunkuser:splunk $SPLUNK_HOME

4. As splunkuser, start Splunk Light. You have two options to do this.

  • Log out from root and log in as splunkuser. Then, run:
$SPLUNK_HOME/bin/splunk start
  • Use sudo or su to start Splunk Light as splunkuser
sudo -H -u splunkuser $SPLUNK_HOME/bin/splunk start
Last modified on 18 August, 2015
Install Splunk Light using Linux
Install and deploy a universal forwarder for Splunk Light

This documentation applies to the following versions of Splunk® Light (Legacy): 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters