I have data stored on one windows os server now I want to install splunk on another windows server by which I can read remote server logs stored. For this i want to know by which user I will require to install splunk? is it local user or domain user or anything else? since I want to access remote server logs using monitor input and what capability this user should have?
I have gone through https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/ChoosetheuserSplunkshouldrunas
Hello
its clearly explained in that doc:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/ChoosetheuserSplunkshouldrunas#The_u...
To do any of the following actions with Splunk Enterprise, you must install it as a domain user
:
Read Event Logs remotely
Collect performance counters remotely
Read network shares for log files
Access the Active Directory schema using Active Directory monitoring
To monitor the logs on the remote server, you should install Splunk as Domain User.
Thanks @mayurr98
If I have local user which can access remote server stored logs then can I install splunk using that local user?