Universal Forwarder Permissions

[Nap]

Is there a specific set of permissions for splunk universal forwarders and its user account? Maybe a document that points to this?

[PickleRick]

There are docs like https://docs.splunk.com/Documentation/Forwarder/9.2.0/Forwarder/Installleastprivileged

Also the recent versions of Windows UF create a user with a relatively limited set of permissions.

But

It's a setup for a limited set of permissions for a typical use case. And as a fairly generic setup it can be both too "closed" (for example, you need a domain user with proper perrmisions to read remote shares) as well as too "open" (you don't need access to Event Log if you're not planning to read from it.