splunkfwd user access to root owned logs - Splunk Community

Getting Data In

Can anyone tell me the best practice for splunkfwd user to access others and root own dir/logs ?

Not interested in changing dir/log ownership.

We could do ACL - lots of work there.

Out of the box what is the access level of the splunkfwd post install ?

Enable the CAP_DAC_READ_SEARCH capability. See https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/Installleastprivileged

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...