From 6f740aeccb850f4dc8d47a2e9963ec83f74a922f Mon Sep 17 00:00:00 2001
From: Robert Castley <robert.castley@gmail.com>
Date: Mon, 12 Oct 2026 08:31:04 +0100
Subject: [PATCH] Splunk Enterprise: start the service as the splunk user
 (#17816)

* Splunk Enterprise: start the service as the splunk user

Splunk Enterprise 10.2 rejects a root start, and the init boot script still launched splunkd as root.

* Ask for the Splunk terms on the Proxmox host

The installer runs under lxc-attach, which has no terminal, so read failed before the terms could be accepted.

* Restore the Splunk terms prompt to the install script

The prompt already runs where the keyboard is attached. The failed read came from launching the test through a pipe.

* Drop Splunk install comments and always start Splunkd
---
 install/splunk-enterprise-install.sh | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/install/splunk-enterprise-install.sh b/install/splunk-enterprise-install.sh
index 26e2abf41..9856f2485 100644
--- a/install/splunk-enterprise-install.sh
+++ b/install/splunk-enterprise-install.sh
@@ -51,8 +51,8 @@ $STD curl -fsSL -o "splunk-enterprise.tgz" "$DOWNLOAD_URL" || {
 }
 $STD tar -xzf "splunk-enterprise.tgz" -C /opt
 rm -f "splunk-enterprise.tgz"
-addgroup --system splunk
-adduser --system --home /opt/splunk --shell /bin/bash --ingroup splunk --no-create-home splunk
+$STD addgroup --system splunk
+$STD adduser --system --home /opt/splunk --shell /bin/bash --ingroup splunk --no-create-home splunk
 chown -R splunk:splunk /opt/splunk
 msg_ok "Setup Splunk Enterprise v${RELEASE}"
 
@@ -64,17 +64,35 @@ Splunk-Credentials
 Username: $ADMIN_USER
 Password: $ADMIN_PASS
 EOF
+chmod 600 ~/splunk.creds
 
-cat <<EOF >"/opt/splunk/etc/system/local/user-seed.conf"
+install -d -o splunk -g splunk -m 755 /opt/splunk/etc/system/local
+cat <<EOF >/opt/splunk/etc/system/local/user-seed.conf
 [user_info]
 USERNAME = $ADMIN_USER
 PASSWORD = $ADMIN_PASS
 EOF
+chown splunk:splunk /opt/splunk/etc/system/local/user-seed.conf
+chmod 600 /opt/splunk/etc/system/local/user-seed.conf
+if ! grep -q '^SPLUNK_OS_USER=' /opt/splunk/etc/splunk-launch.conf; then
+    echo 'SPLUNK_OS_USER=splunk' >>/opt/splunk/etc/splunk-launch.conf
+fi
+chown splunk:splunk /opt/splunk/etc/splunk-launch.conf
 msg_ok "Created Splunk admin user"
 
 msg_info "Starting Service"
-$STD sudo -u splunk /opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt
-$STD /opt/splunk/bin/splunk enable boot-start -user splunk
+$STD sudo -H -u splunk /opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt
+$STD sudo -H -u splunk /opt/splunk/bin/splunk stop --answer-yes --no-prompt
+$STD /opt/splunk/bin/splunk enable boot-start \
+    -systemd-managed 1 \
+    -user splunk \
+    -group splunk \
+    --accept-license \
+    --answer-yes \
+    --no-prompt
+chown -R splunk:splunk /opt/splunk
+$STD systemctl daemon-reload
+$STD systemctl enable --now Splunkd
 msg_ok "Started Service"
 
 motd_ssh