Moving to a least privileged model for service accounts, what permissions are needed for WMI collections, the universal forwarder, and folder monitoring and database connections?

[sbattista09]

We are moving to a least privileged model for service accounts and I have to ask the question of what permissions Splunk needs for the following:

What permissions will be needed for WMI collections?
What permissions will be needed for the Universal forwarder?

What permissions will be needed for folder monitor and database connections?

[esix_splunk · Accepted solution]

You should read this first : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/ChoosetheuserSplunkshouldrunas

That outlines the different permissions that are required.

Reading files on disk, permissions are based upon standard RWXD permissions on ntfs etc.

For Database Connections, it will depend on which DB you connect to. MS supports AD credentials, where as mysql / oracle etc require ldap or local DB auth.