Universal Forwarder logs

[engrimranzakir]

Hi All,

As i install universal forwarder on different pc using local user in domain environment  logs received at Splunk enterprise, when i used domain user it did not. Did someone face this issue ?  

[engrimranzakir]

I applied the group policy on other machines but cannot collect logs, while when using local policy on machines no problem in receiving logs.

[isoutamo]

Have you check that your policy contains at least these?

• https://docs.splunk.com/Documentation/Forwarder/8.2.4/Forwarder/InstallaWindowsuniversalforwarderfro...
• https://docs.splunk.com/Documentation/Splunk/8.2.4/Installation/ChoosetheuserSplunkshouldrunas
  
  

Also check that user has read access  to files and directories.

r. Ismo

[tscroggins]

@engrimranzakir 

Splunk Universal Forwarder assumes it is running as SYSTEM; otherwise, you must explicitly grant the user the necessary permissions and rights to both access objects and log on as a service. Did the domain user have the same group memberships and user rights as the local user?