All Apps and Add-ons

Does the account that the Splunk service uses require interactive logon rights to execute scripts?

rbaker_isc
Engager

We have SOS and the Windows Infrastructure apps installed. Just curious if the scripts are executed by the Splunk Search server remotely on the target systems, or by the UF on the target systems? Either way, does the account the Splunk service is started with require interactive logon rights to execute scripts?

1 Solution

hexx
Splunk Employee
Splunk Employee

So, I'm going to assume you are talking about scripted inputs (as opposed to custom search commands, for example).

As far as S.o.S is concerned, these scripted inputs (and on Windows there is only one, really: ps_sos.ps1) runs locally and collects resource usage information about Splunk processes running on the local machine only.

If you want to benefit from the same level of information from forwarders or from your indexers, you'll need to install the S.o.S add-on for Windows there.

With that in consideration, interactive logon permissions are not in scope of course, but the execution of unsigned Powershell scripts is.

For more information on all of this, please consult the S.o.S User Manual.

View solution in original post

hexx
Splunk Employee
Splunk Employee

So, I'm going to assume you are talking about scripted inputs (as opposed to custom search commands, for example).

As far as S.o.S is concerned, these scripted inputs (and on Windows there is only one, really: ps_sos.ps1) runs locally and collects resource usage information about Splunk processes running on the local machine only.

If you want to benefit from the same level of information from forwarders or from your indexers, you'll need to install the S.o.S add-on for Windows there.

With that in consideration, interactive logon permissions are not in scope of course, but the execution of unsigned Powershell scripts is.

For more information on all of this, please consult the S.o.S User Manual.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!