Installation

Universal Forwarder logs

engrimranzakir
Explorer

Hi All,

As i install universal forwarder on different pc using local user in domain environment  logs received at Splunk enterprise, when i used domain user it did not. Did someone face this issue ?  

Labels (2)
Tags (1)
0 Karma

engrimranzakir
Explorer

I applied the group policy on other machines but cannot collect logs, while when using local policy on machines no problem in receiving logs.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

tscroggins
Influencer

@engrimranzakir 

Splunk Universal Forwarder assumes it is running as SYSTEM; otherwise, you must explicitly grant the user the necessary permissions and rights to both access objects and log on as a service. Did the domain user have the same group memberships and user rights as the local user?

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...