Hi,
When we restart splunk forwarder from deployment -server does it start
1) based on user defined in boot script OR
2) Based on the UserId under which is installed.
Suppose Splunk is installed under user "splunk" and boot script is defined to start as root user.
So when Splunk restarted by DS, does it run as root or splunk user .
↧