TailingProcessor - Insufficient permissions to read file (hint: Access is denied.).

New Member


I've set the splunkd service account to a domain account that has local administrator rights on both the splunk server machine and the client from where i need to access the file share. I've also checked that the user has full control on the shared folder (Share and NTFS permissions) however i'm still getting : TailingProcessor - Insufficient permissions to read file (hint: Access is denied.) when splunk tries to read those files.

The splunk server is on Windows 2003 Machine (x86) while the file share is located on a Windows Server 2008 R2 machine (x64). I'm using version Splunk 4.1.7.

Let me know if you have any ideas on why splunk isn't reading data from the log files in the fileshare.

Regards, Cosmin

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Are you using drive letter mappings or a UNC path? Have you logged in as the Splunk account on the Splunk server machine and tested to see if you can open the file?

0 Karma


Could it be locked by another process(you could check with Process Explorer)? or denied by antivirus(you could test excluding Splunk folder in your AV configuration)?

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...