All Apps and Add-ons

What access for Windows Splunk User on an intermediate Forwarder?

jbrocks
Communicator

I need to install a Heavy Forwarder which is used as an intermediate Forwarder on a Windows Server. What access does the Windows user need that is supposed to run Splunk? Thanks! We have Universal Forwarders forwarding AD to the Heavy Forwarder, which takes them by port 9997 and outputs data to the indexers on port 9997.
Do we need domain user for the Heavy Forwarder or Local User?

0 Karma
1 Solution

dkeck
Influencer
0 Karma

jbrocks
Communicator

Hi, thanks, yes I still saw this and think a local user should do it, but I am not sure, that's why I am asking.

0 Karma

dkeck
Influencer

Please accept answer if it helped 🙂 thank you

0 Karma

dkeck
Influencer

local should work

0 Karma

vincenteous
Communicator

If you're only using your HF as intermediary server and not for monitoring AD object, a local user should be sufficient enough.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...