How to install Splunk as a non root user.
Its a security risk to run everything as a root user, so if you can, you should use a dedicated user for your program.
This tutorial will show how to install Splunk as a user with name splunk on your Ubuntu server (may work on other as well)
Download latest Splunk Enterprise to you /tmp folder
Create the splunk user:
sudo useradd -c "splunk user" -m -s /bin/bash -U -d /opt/splunk splunk
Log in a the splunk user:
sudo su - splunk
Download Splunk Linux tgz file to /tmp folder
Extract the Splunk software to /opt folder (name of file will change with new version):
tar xvzf /tmp/splunk-8.0.3-a6754d8441bf-Linux-x86_64.tgz -C /opt
Start your Splunk server (accept license agrement and set a password for Spkunk admin user):
~/bin/splunk start
Add a user/password to login to Splunk.
As a root user, make Splunk autostart with user splunk as a startup script:
sudo /opt/splunk/bin/splunk enable boot-start -user splunk
You should now be up and running on port 8000 (can be changed)
Remember to use splunk user whenever you change/add files or do anything else with Splunk from the CLI
sudo su - splunk
PS:
If you run Splunk as a non root user then you can not use UDP/514 as a syslog receiver port in Splunk.
Since all port below 1024 need root permission to work.
Workarounds.
- Send syslog to other port above 1023, like 1514 for UDP syslog. (need to change many routers to send to correct port)
- Set up a local syslog server like r-syslog and let Splunk read the r-syslog log files.
http://forum.mikrotik.com/t/tool-using-splunk-to-analyse-mikrotik-logs-3-3-graphing-everything/121810/13