An RPM is like an MSI for Windows. It contains the software and any instructions needed to run the software. In this case, Splunk packaged their RPM to create a user called Splunk because it's safer to run Splunk as a non-root user. This does come at a disadvantage (such as not being able to bind ports under 1024).
If you want to use the RPM (because you should if you're running Redhat, Centos, etc. etc.) but you don't want the user, then I suggest simply removing the user/group and chown the splunk directory
userdel splunk
groupdel splunk
chown -Rh $newuser.$newgroup /opt/splunk (eg. chown -Rh splunker.splunker /opt/splunk)
This will remove the splunk user, delete the splunk group and set the ownership of /opt/splunk (and anything under it) to your new user. You will have to create that specific user and group first though.
Rebuilding the forwarder RPM is a pain to do. To do it properly, you'd need the source RPM which we don't have. Also, if you were to extract the existing package, edit the post-installation triggers to stop the creation of the Splunk user then you'd have to rebuild the package but you wouldn't be able to sign it with Splunk's GPG key. So you'd have to leave it unsigned or use a key of your own which is trusted by your systems.
All in all, if you don't want the splunk user on your system then just remove it and make sure that files are owned by another user instead or use the tarball which you can simply extract to a certain directory and just run Splunk.
