we installed Splunk Forwarder in a windows 2012 R2 server. firstly we use Local System running the service.
it works fine. and now I changed the service logon as our CORP account. and give the whole SplunkUniversalForwarder folder modify access to our CORP account. then I try to start the service.
but failed. the error message is below
The Splunk Forwarder Service service on Local Computer started and then stopped.
Some services stop automatically if they are not in use by other services or programs
