It seems like with the WIndows version of splunk, you must have admin to run splunk.exe, which includes command line queries. Since I want non-admin users of the machine to review audit logs, how can I change this so that other users can run splunk.exe?
I checked the "run as admin" in the compatiability tab of the file, but the "run this program as administrator" box is already unchecked, but I still need admin to run it.
So if you right click on the splunk.exe in the bin folder and go to the compatibility tab.
Did you click "change settings for all users" and then set privilege level to run this program as administrator?
Alternativly can you give the non admin users ability to view the audit index though role permissions?