Re: splunkfwd user access to root owned logs - Splunk Community

Getting Data In

Can anyone tell me the best practice for splunkfwd user to access others and root own dir/logs ?

Not interested in changing dir/log ownership.

We could do ACL - lots of work there.

Out of the box what is the access level of the splunkfwd post install ?

Enable the CAP_DAC_READ_SEARCH capability. See https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/Installleastprivileged

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl. To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...