All Apps and Add-ons

What access for Windows Splunk User on an intermediate Forwarder?

Communicator

I need to install a Heavy Forwarder which is used as an intermediate Forwarder on a Windows Server. What access does the Windows user need that is supposed to run Splunk? Thanks! We have Universal Forwarders forwarding AD to the Heavy Forwarder, which takes them by port 9997 and outputs data to the indexers on port 9997.
Do we need domain user for the Heavy Forwarder or Local User?

0 Karma
1 Solution

Influencer
0 Karma

Influencer
0 Karma

Communicator

Hi, thanks, yes I still saw this and think a local user should do it, but I am not sure, that's why I am asking.

0 Karma

Influencer

Please accept answer if it helped 🙂 thank you

0 Karma

Influencer

local should work

0 Karma

Communicator

If you're only using your HF as intermediary server and not for monitoring AD object, a local user should be sufficient enough.

0 Karma