which user does splunk run as?