Arch Linux User Repository

This package is already configured to run as the unprivileged splunk user (their old recommendation). I'd be hesitant to change that to splunkfwd as per their current documentation because that would likely break existing installations without some manual intervention. That said though, I will look at bringing the systemd unit file more in line with the example they have in the next update.

Starting from version 9.x.x splunkforwarder provides a systemd unit files and provides some guideline how to integrate with systemd https://docs.splunk.com/Documentation/Forwarder/9.1.2/Forwarder/Installleastprivileged.

Also it has support for capabilities and recommends using it under splunkfwd user.

Starting with 8.2.0, the only supported ARM platform is armv8/aarch64. Support for armv6/armv7 has been dropped upstream.

https://docs.splunk.com/Documentation/Splunk/8.2.0/ReleaseNotes/Deprecatedfeatures

Starting with 7.1.3, 32-bit is no longer supported in the main Splunk release. Instead, 32-bit support continues in the 6.3.* series.

If there are any 32-bit users out there, let me know and I will create a separate 32-bit package for Splunk.

Starting with 6.5.0, Splunk now ships with an empty users.ini file (located in /opt/splunkforwarder/etc/users). If you are having issues upgrading, try deleting this file first (it is normally empty, so this shouldn't be a problem).