topic Re: Splunk UF file permissions on windows servers in Getting Data In

Splunk UF file permissions on windows servers?

Roy_9 — Wed, 05 Apr 2023 16:27:39 GMT

Hello,

In order to monitor a file via UF, those files should grant read-only permissions user and group as splunk:splunk on linux servers,

I have doubt on windows servers whether the user and group (splunk:splunk) is an active directory service account and group?

Thanks

Re: Splunk UF file permissions on windows servers

richgalloway — Tue, 04 Apr 2023 16:01:47 GMT

Windows does not grant file access the same way that Linux does so instructions for Linux don't necessarily apply to Windows.

On any platform, the user running the UF needs read access to any files being monitored by the UF. On Windows, that's usually a local user, but can be a domain account.