Getting Data In

install splunk by local user to monitor remote server logs windows os

Contributor

I have data stored on one windows os server now I want to install splunk heavy forwarder on another windows server by which I can read remote server logs stored. For this i want to know by which user I will require to install splunk?
If I have local user which has read access to shared directory then can I install splunk using same user?
since I want to access remote server logs using monitor input and what capability this user should have?
I have gone through https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/ChoosetheuserSplunkshouldrunas

0 Karma

Splunk Employee
Splunk Employee

As long as that user can read the event logs, you should be fine. Also, is there a reason you are using a Heavy Forwarder? There are only really a few cases where you need a Heavy Forwarder as opposed to a Universal Forwarder. That would be if you are filtering a large portion of the data out to save on bandwidth, or if you are using an add-on like DB Connect, AWS Add-on, etc..., that requires a GUI to configure inputs.

Heavy forwarders actually increase the size of your data because the data is "cooked", so unless you are filtering the majority, this is not recommended. Also, with Windows, you could blacklist Event Codes anyway, so this isn't required if that is the reason you are looking at a Heavy Forwarder. I don't recommend filtering out data in the first place because I have seen customers inadvertantly filter out things that they found would have been helpful. You don't know what you don't know.

Contributor

Thanks @kmorris_splunk
Yes I am filtering many data at heavy forwarder level due to license issue from customer and I am not ingesting windows event logs but there are some machine which are generating logs in zip format and stores it on server and I am taking remote server access and filter logs on heavy forwarder level.
Also I am using db connect but it is already setup on search head in production so will I need to send it to Heavy forwarder after setup or can keep as it is.

0 Karma