There are docs like https://docs.splunk.com/Documentation/Forwarder/9.2.0/Forwarder/Installleastprivileged
Also the recent versions of Windows UF create a user with a relatively limited set of permissions.
But
It's a setup for a limited set of permissions for a typical use case. And as a fairly generic setup it can be both too "closed" (for example, you need a domain user with proper perrmisions to read remote shares) as well as too "open" (you don't need access to Event Log if you're not planning to read from it.
