So, I'm going to assume you are talking about scripted inputs (as opposed to custom search commands, for example). As far as S.o.S is concerned, these scripted inputs (and on Windows there is only one, really: ps_sos.ps1 ) runs locally and collects resource usage information about Splunk processes running on the local machine only. If you want to benefit from the same level of information from forwarders or from your indexers, you'll need to install the S.o.S add-on for Windows there. With that in consideration, interactive logon permissions are not in scope of course, but the execution of unsigned Powershell scripts is. For more information on all of this, please consult the S.o.S User Manual. ... View more