topic splunk default user in Deployment Architecture

splunk default user

NeedNotToKnow — Fri, 26 May 2023 13:30:53 GMT

When I install Splunk Enterprise or Splunk universal forwarder on Linux I note that by default making a new user named splunk right?

And then I enable boot-start for this user
and all things are good

But on Windows, there is no default user made named splunk
so should I make the user manually, then enable boot-start from this user?
Also, how can I know who is the user who running splunk on my Windows machine?
Even if it's Splunk Enterprise or Splunk Universal Forwarder

Re: splunk default user

richgalloway — Fri, 26 May 2023 16:43:05 GMT

There's nothing to do on Windows. Boot-start is enabled automatically by the installer.

Splunk runs as a service on Windows.

Re: splunk default user

isoutamo — Fri, 26 May 2023 17:07:53 GMT

it’s like @richgalloway said, in most cases you don’t need to create separate user for UF. But if you need remotely read AD or access shares then you should read this https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/ChoosetheuserSplunkshouldrunas

r. Ismo