All Apps and Add-ons

What access for Windows Splunk User on an intermediate Forwarder?

jbrocks
Communicator

I need to install a Heavy Forwarder which is used as an intermediate Forwarder on a Windows Server. What access does the Windows user need that is supposed to run Splunk? Thanks! We have Universal Forwarders forwarding AD to the Heavy Forwarder, which takes them by port 9997 and outputs data to the indexers on port 9997.
Do we need domain user for the Heavy Forwarder or Local User?

0 Karma
1 Solution

dkeck
Influencer
0 Karma

dkeck
Influencer
0 Karma

jbrocks
Communicator

Hi, thanks, yes I still saw this and think a local user should do it, but I am not sure, that's why I am asking.

0 Karma

dkeck
Influencer

Please accept answer if it helped 🙂 thank you

0 Karma

dkeck
Influencer

local should work

0 Karma

vincenteous
Communicator

If you're only using your HF as intermediary server and not for monitoring AD object, a local user should be sufficient enough.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!