Splunk Enterprise runs in the context of a user account on the machine where you installed the software. For an improved security profile, practice the principle of least privilege by running Splunk Enterprise as a user with low privileges rather than using a privileged account such as root or Administrator.

To apply the principle of least privilege in Splunk Enterprise operations,

• On Unix or Linux, use the "splunk" user that the Splunk .pkg and .rpm installation packages create. Alternatively, create a non-privileged user that has access to and ownership of the $SPLUNK_HOME directory.
• On Windows, the Local System user is often the best choice to run Splunk Enterprise. If you require access to files or directories over a network or communication using a service such as Windows Management Instrumentation, use a standard Windows account and restrict access only to the things you need to monitor. For more information, see the following topics in the Installation Manual:
  • Choose the Windows user Splunk Enterprise should run as
  • Prepare your Windows network to run Splunk Enterprise as a network or domain user.