Getting Data In

Splunk User of windows SplunkForwarder

maede_yavari
Explorer

Hello,

I'm encountering an issue with Splunk Forwarder on a Windows Server OS. When it runs under the "SplunkForwarder" user, it fails to send Sysmon logs. Surprisingly, the forwarding works correctly when the forwarder is configured to run as the "SYSTEM" user.

While this resolves the immediate problem, I'm hesitant to continue using the "SYSTEM" user due to its extensive access to system resources. I'm seeking a better solution that allows the Splunk Forwarder to send Sysmon logs without compromising security. Any guidance on this matter would be greatly appreciated.

Thank you.

Labels (1)
0 Karma

jhoney12
Observer

This discussion has been very informative.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @maede_yavari,

this isn't a Splunk issue: if you want to have more security running Splunk Universal Forwarder with a not LOCAL SYSTEM user, you have to give to the user that you're using the grants to read you eventlog: you need a Windows technician, or you could accept to run Splunk using SYSTEM.

Ciao.

Giuseppe

Shahrukh_S
Engager

"NT service\splunkforwarder" does not have native permission levels to read from all the windows log channels, especially the SECURITY log channel and SYSMON channels. The easiest option is to add "NT Service\SplunkForwarder" object to the "Event Log Readers" group in the system. 

Or create a domain user, restart all the instances of SplunkForwarder service with the newly created domain user and come up with a GPO to add the domain user to "Event Log Readers". 


whrg
Motivator

Many thanks! I was troubleshooting why Splunk was not reading out the Security event log. After adding "NT Service\SplunkForwarder" to the "Event Log Readers" group, it finally works.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @whrg ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Please read this https://docs.splunk.com/Documentation/Splunk/9.3.0/Installation/ChoosetheuserSplunkshouldrunas 
It describes how splunk works in windows and which kind of user you should select to fulfill your requirements.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...