I have question on restarting a Splunk Forwarder when rolling out a new app. In the serverclass.conf file, I'm adding a new app to an existing forwarder. Elsewhere in the serverclass.conf, the forwarder belongs to a server class that contains the restartSplunkd = true statement. When Splunk restarts on the forwarder, what user will it start with? I would like it to restart with a user named splunk, since we have a non-root user running splunk. If I've enabled splunk to restart on boot with a non-root user, will it use that user to start splunk? Any help is greatly appreciated!
Splunk should restart with the user that you have it configured to run as when you did the install and enabled the boot start.