https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318962#M59597 <P>I have a Splunk forwarder under oraepm functional user and I am trying to read logs that are owned by a different functional userid. </P> <P>Do I need to install one more Splunk forwarder with the new userid?</P> Mon, 04 Dec 2017 16:35:47 GMT thirulog 2017-12-04T16:35:47Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318962#M59597 <P>I have a Splunk forwarder under oraepm functional user and I am trying to read logs that are owned by a different functional userid. </P> <P>Do I need to install one more Splunk forwarder with the new userid?</P> Mon, 04 Dec 2017 16:35:47 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318962#M59597 thirulog 2017-12-04T16:35:47Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318963#M59598 <P>Others will probably disagree with me, but a Universal Forwarder should run as a privileged account or member of a privileged group. </P> <P>If that is not palatable to you or your organization then add oraepm to the group which ownes the logs it cannot read.</P> Mon, 04 Dec 2017 18:44:43 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318963#M59598 lycollicott 2017-12-04T18:44:43Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318964#M59599 <P>Installing more than one forwarder on a system is complicated and usually doesn't work as expected.<BR /> The preferred solution is to use ACLs to grant user oraepm read access to the logs.</P> Mon, 04 Dec 2017 18:51:48 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318964#M59599 richgalloway 2017-12-04T18:51:48Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318965#M59600 <P>thank you I have grant user oraepm read access to the logs.</P> Mon, 04 Dec 2017 19:52:29 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318965#M59600 thirulog 2017-12-04T19:52:29Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318966#M59601 <P>thank you I have grant user oraepm read access to the logs.</P> Mon, 04 Dec 2017 20:33:40 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-unable-to-read-logs-owned-by-a-different/m-p/318966#M59601 thirulog 2017-12-04T20:33:40Z