Trying to start a Splunk forwarder with Citrix 3rd party as domain user, why am I getting a 1067 error (process terminated unexpectedly)?

[Michael_Carlisl]

I'm hitting a 1067 error (process terminated unexpectedly) when starting the service. If I make the user a local admin or a domain admin, everything works fine. I don't want to do this for security reasons. Is there a way to just grant the rights the service account needs to get this service started?

Thanks!
Michael

[jconger]

Check out the guidelines on what the Windows account needs? -> http://docs.splunk.com/Documentation/Splunk/6.4.0/Installation/ChoosetheuserSplunkshouldrunas

Are you using one of the Splunk Apps/Templates for your Citrix environment? If so, in addition to the guidelines above, you will need to make sure the account is a Citrix admin in order to run the necessary PowerShell cmdlets.