splunk server can run as the 'splunk' user or 'root' (splunk default).  Serverspec tests were added to help validate this.  When running as non-privelaged userplease use a web_port > 1023 (priveleged port problem).  Lastly turned splunk init script into template as 'splunk enable boot-start --accept-license --answer-us --user splunk' doesn't seem to support the --user flag anymore.  Implemented a lot of helpful feedback from Joshua Timberman.