Secure Splunk Enterprise service accounts

Splunk Enterprise runs in the context of a user account on the machine where you installed the software. For an improved security profile, practice the principle of least privilege by running Splunk Enterprise as a user with low privileges rather than using a privileged account such as root or Administrator.

To apply the principle of least privilege in Splunk Enterprise operations,

On Unix or Linux, use the "splunk" user that the Splunk .pkg and .rpm installation packages create. Alternatively, create a non-privileged user that has access to and ownership of the $SPLUNK_HOME directory.
On Windows, the Local System user is often the best choice to run Splunk Enterprise. If you require access to files or directories over a network or communication using a service such as Windows Management Instrumentation, use a standard Windows account and restrict access only to the things you need to monitor. For more information, see the following topics in the Installation Manual:
- Choose the Windows user Splunk Enterprise should run as
- Prepare your Windows network to run Splunk Enterprise as a network or domain user.

Related answers from Splunk Community

Secure Splunk Enterprise service accounts

Comments

Was this topic useful?