made some further changes to support switching from root to splunk and vice versa