topic Re: Universal Forwarder logs in Installation

Universal Forwarder logs

engrimranzakir — Thu, 30 Dec 2021 10:04:22 GMT

Hi All,

As i install universal forwarder on different pc using local user in domain environment logs received at Splunk enterprise, when i used domain user it did not. Did someone face this issue ?

Re: Universal Forwarder logs

tscroggins — Sun, 02 Jan 2022 19:05:25 GMT

@engrimranzakir

Splunk Universal Forwarder assumes it is running as SYSTEM; otherwise, you must explicitly grant the user the necessary permissions and rights to both access objects and log on as a service. Did the domain user have the same group memberships and user rights as the local user?

Re: Universal Forwarder logs

engrimranzakir — Tue, 04 Jan 2022 13:15:40 GMT

I applied the group policy on other machines but cannot collect logs, while when using local policy on machines no problem in receiving logs.

Re: Universal Forwarder logs

isoutamo — Tue, 04 Jan 2022 16:31:21 GMT

Have you check that your policy contains at least these?

Also check that user has read access to files and directories.

r. Ismo