When I install Splunk Enterprise or Splunk universal forwarder on Linux I note that by default making a new user named splunk right?
And then I enable boot-start for this user
and all things are good
But on Windows, there is no default user made named splunk
so should I make the user manually, then enable boot-start from this user?
Also, how can I know who is the user who running splunk on my Windows machine?
Even if it's Splunk Enterprise or Splunk Universal Forwarder
There's nothing to do on Windows. Boot-start is enabled automatically by the installer.
Splunk runs as a service on Windows.
There's nothing to do on Windows. Boot-start is enabled automatically by the installer.
Splunk runs as a service on Windows.
Hi
it’s like @richgalloway said, in most cases you don’t need to create separate user for UF. But if you need remotely read AD or access shares then you should read this https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/ChoosetheuserSplunkshouldrunas
r. Ismo