If a DHCP is assigning IP address to your Splunk server, do not go for this.  You will also need to add the following line to /etc/system/local/web.conf  [settings] mgmtHostPort = 10.10.x.x:8089 _______________________________________________________________ Otherwise, splunk default stanza (below) will look for splunkd at its loopback address.  /opt/splunk/etc/system/default/web.conf mgmtHostPort = 127.0.0.1:8089 ... View more

"NT service\splunkforwarder" does not have native permission levels to read from all the windows log channels, especially the SECURITY log channel and SYSMON channels. The easiest option is to add "NT Service\SplunkForwarder" object to the "Event Log Readers" group in the system.  Or create a domain user, restart all the instances of SplunkForwarder service with the newly created domain user and come up with a GPO to add the domain user to "Event Log Readers".  ... View more