Handle forwarder user in the params class since it is so different now

manifests/forwarder.pp

@@ -165,10 +165,7 @@
   Boolean $manage_package_source             = true,
   Optional[String[1]] $package_source        = undef,
   Splunk::Fwdinstalloptions $install_options = $splunk::params::forwarder_install_options,
-  String[1] $splunk_user                     = versioncmp($version, '9.1.0') ? {
-    -1 => $splunk::params::splunk_user,
-    default => 'splunkfwd',
-  },
+  String[1] $splunk_user                     = $splunk::params::splunk_forwarder_user,
   Stdlib::Absolutepath $forwarder_homedir    = $splunk::params::forwarder_homedir,
   Stdlib::Absolutepath $forwarder_confdir    = $splunk::params::forwarder_confdir,
   String[1] $service_name                    = $splunk::params::forwarder_service,

manifests/params.pp

@@ -29,6 +29,9 @@
 # @param splunk_user
 #   The user that splunk runs as.
 #
+# @param splunk_forwarder_user
+#   The user that splunk forwarder runs as.
+#
 # @param src_root
 #   The root URL at which to find the splunk packages. The sane-default logic
 #   assumes that the packages are located under this URL in the same way that
@@ -114,6 +117,10 @@
     'windows' => 'Administrator',
     default => versioncmp($version, '8.0.0') ? { -1 => 'root', default => 'splunk' },
   },
+  String[1] $splunk_forwarder_user           = $facts['os']['family'] ? {
+    'windows' => versioncmp($version, '9.1.0') ? { -1 => 'Administrator', default => 'splunkfwd' },
+    default => versioncmp($version, '9.1.0') ? { -1 => 'root', default => 'splunkfwd' },
+  },
   String[1] $default_host                    = $facts['clientcert'],
   Boolean $manage_net_tools                  = true,
   Boolean $allow_insecure                    = false,