https://community.splunk.com/t5/Getting-Data-In/Why-can-t-my-Splunk-instance-read-a-file-on-another-machine/m-p/11091#M510 <P>By default on Windows, Splunk runs as 'Local System User' which isn't really a 'user' in the normal sense. It's simply a collection of basic permissions and capabilities that allows Splunk to run as a service, execute scripts etc. Normally, these permissions only extend to the limits of the local box, and to access network resources, you need to run as a user with domain permissions </P> <P>Its all documented here - <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Installation/ChoosetheuserSplunkshouldrunas" rel="nofollow">http://docs.splunk.com/Documentation/Splunk/5.0/Installation/ChoosetheuserSplunkshouldrunas</A> </P> <P>Most notable part - </P> <P>If you intend to do any of the following things, you must give Splunk a Domain account:</P> <PRE><CODE>* read Event Logs remotely * collect performance counters remotely * read network shares for log files * enumerate the Active Directory schema using Active Directory monitoring </CODE></PRE> Thu, 08 Apr 2010 01:13:37 GMT Mick 2010-04-08T01:13:37Z https://community.splunk.com/t5/Getting-Data-In/Why-can-t-my-Splunk-instance-read-a-file-on-another-machine/m-p/11090#M509 <P>I'm trying to index a file on a mapped network drive, but I keep getting seeing 'Access is denied' in splunkd.log. I can read the file ok from my server, why can't Splunk?</P> <P>Splunk is running on Windows 2003 R2 32-bit</P> Thu, 08 Apr 2010 01:10:30 GMT https://community.splunk.com/t5/Getting-Data-In/Why-can-t-my-Splunk-instance-read-a-file-on-another-machine/m-p/11090#M509 Mick 2010-04-08T01:10:30Z https://community.splunk.com/t5/Getting-Data-In/Why-can-t-my-Splunk-instance-read-a-file-on-another-machine/m-p/11091#M510 <P>By default on Windows, Splunk runs as 'Local System User' which isn't really a 'user' in the normal sense. It's simply a collection of basic permissions and capabilities that allows Splunk to run as a service, execute scripts etc. Normally, these permissions only extend to the limits of the local box, and to access network resources, you need to run as a user with domain permissions </P> <P>Its all documented here - <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Installation/ChoosetheuserSplunkshouldrunas" rel="nofollow">http://docs.splunk.com/Documentation/Splunk/5.0/Installation/ChoosetheuserSplunkshouldrunas</A> </P> <P>Most notable part - </P> <P>If you intend to do any of the following things, you must give Splunk a Domain account:</P> <PRE><CODE>* read Event Logs remotely * collect performance counters remotely * read network shares for log files * enumerate the Active Directory schema using Active Directory monitoring </CODE></PRE> Thu, 08 Apr 2010 01:13:37 GMT https://community.splunk.com/t5/Getting-Data-In/Why-can-t-my-Splunk-instance-read-a-file-on-another-machine/m-p/11091#M510 Mick 2010-04-08T01:13:37Z