Change user from splunk to root