×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
TopcaT668
Explorer
Member since: ‎10-17-2022
‎10-18-2022
Community Statistics
Posts 3
Solutions 0
Karma Given 4
Karma Received 0
Member Since ‎10-17-2022
View All

Re: User Account that UF wants when installing it-...

by in Splunk Enterprise
‎10-18-2022 05:48 AM
‎10-18-2022 05:48 AM
This may be my misunderstanding - I need Splunk UF to be running and exporting data about the machine when no-one is logged on.  There are five machines involved, three which forward logs to a fourth also running UF, which then forwards to a Splunk Enterprise instance.   I am I'll admin quite confused, however I believe (but it is likely wrong) that to allow the service to continue to operate once all human users are logged off it needs a service account? My next issue if that's true is that these are all Domain Joined, so I don;t seem to be able to create a local machine service account, I may need a domain Managed Service account.  I'm chasing down a rabbit hole I fear! 🙂 ... View more

Re: Splunk Universal Forwarder

by in Splunk Enterprise
‎10-18-2022 01:06 AM
‎10-18-2022 01:06 AM
Hi and thank you for the reply. So could I please clarify - during the Universal Forwarder I am asked at one dialogue to enter a username and a password twice, or allow the installer to generate a random password - at that step I am adding a new account which Splunk will use to authenticate user(s) at the CLI. I suppose that my next question is more a Windows question however I will ask here, with apologies if it is inappropriate: I have logged into the VM I am installing UF onto using my own domain account, and have installed the Universal Forwarder.  I'm not sure I understand how I create a separate service account to allow Splunk to operate.   As always, any and all help very very gratefully received, thank you   ... View more

User Account that UF wants when installing it- doe...

by in Splunk Enterprise
‎10-17-2022 11:11 AM
‎10-17-2022 11:11 AM
Hi, Utter Noob here - I apologise for any really silly questions! I'm installing Universal Forwarder to several machines which will forward data to a further intermediate instance, and then on to Enterprise. My question is around the User Account that UF wants when I'm installing it.  does this have to be a local service account or can it be a Domain User account?  I'm asking as when I on a domain joined machine, I have created a SplunkAdmin local user, but when I go to the Local Security  Policy > Local Policies>User Rights Assignment > Log in as a service to add the local account the account is not shown, just the Domain accounts and groups. Does this mean I need to create a Splunk account at the domain (AD) level and use it on all machines where I am installing Splunk Universal Forwarder?  Thanks any and all help! ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎10-18-2022 12:54 PM
Karma given to
View All
li.common.scroll-to.top