Installation

Universal Forwarder logs

engrimranzakir
Explorer

Hi All,

As i install universal forwarder on different pc using local user in domain environment  logs received at Splunk enterprise, when i used domain user it did not. Did someone face this issue ?  

Labels (2)
Tags (1)
0 Karma

engrimranzakir
Explorer

I applied the group policy on other machines but cannot collect logs, while when using local policy on machines no problem in receiving logs.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

tscroggins
Influencer

@engrimranzakir 

Splunk Universal Forwarder assumes it is running as SYSTEM; otherwise, you must explicitly grant the user the necessary permissions and rights to both access objects and log on as a service. Did the domain user have the same group memberships and user rights as the local user?

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...