Getting Data In

install splunk by local user to monitor remote server logs windows os

ips_mandar
Builder

I have data stored on one windows os server now I want to install splunk heavy forwarder on another windows server by which I can read remote server logs stored. For this i want to know by which user I will require to install splunk?
If I have local user which has read access to shared directory then can I install splunk using same user?
since I want to access remote server logs using monitor input and what capability this user should have?
I have gone through https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/ChoosetheuserSplunkshouldrunas

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

As long as that user can read the event logs, you should be fine. Also, is there a reason you are using a Heavy Forwarder? There are only really a few cases where you need a Heavy Forwarder as opposed to a Universal Forwarder. That would be if you are filtering a large portion of the data out to save on bandwidth, or if you are using an add-on like DB Connect, AWS Add-on, etc..., that requires a GUI to configure inputs.

Heavy forwarders actually increase the size of your data because the data is "cooked", so unless you are filtering the majority, this is not recommended. Also, with Windows, you could blacklist Event Codes anyway, so this isn't required if that is the reason you are looking at a Heavy Forwarder. I don't recommend filtering out data in the first place because I have seen customers inadvertantly filter out things that they found would have been helpful. You don't know what you don't know.

ips_mandar
Builder

Thanks @kmorris_splunk
Yes I am filtering many data at heavy forwarder level due to license issue from customer and I am not ingesting windows event logs but there are some machine which are generating logs in zip format and stores it on server and I am taking remote server access and filter logs on heavy forwarder level.
Also I am using db connect but it is already setup on search head in production so will I need to send it to Heavy forwarder after setup or can keep as it is.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...