Should we install forwarders, indexers and search head as local system or domain account for Windows Infrastructure app?

[jlhesurance]

If we intend to use the Splunk App for Windows Infrastructure to collect security-related logs (such as Logon/Logoff, GP changes, etc.), should we install the Forwarders, Indexers and Search Head as the Local System account or a domain account? The documentation is pretty clear that the Forwarders should be installed as Local System with no inputs enabled, but it's less clear about the other components.

[jbernt_splunk]

Hi there. The forwarders and the account they run as are the only ones that really matter in this case. The Indexers and Search Heads can run on any supported OS, so the Local System account won't be available there anyway. You can run with a domain account, but we recommend Local System if possible unless there is a need to run as a domain user for least privilege.
Thanks!