You have to change the service account in the Services Control panel, and change the ownership/permissions of all Splunk files. You'll find that the permissions of some files (e.g. Splunk indexes, Splunk internal logs file directory) are set by default to only be accessible by the initial installed Splunk user account. Easiest thing to do it to go to the installation directory and cascade your ownership changes down. Alternatively, you can uninstall and reinstall providing the new user name, though this will delete everything in your install (including any indexed data, unless you moved it to a new location). Note BTW that if you want to collect Windows Security Event Logs, basically you need to be an admin on the DC (and hence the domain). There is a way around it if you have to do it, but I would recommend against it. http://www.splunk.com/support/forum:SplunkAdministration/4128 http://blogs.msdn.com/ericfitz/archive/2006/03/01/541462.aspx http://support.microsoft.com/kb/323076 ... View more

i am using juniper ISG 2000, i am looking for splunk app, which can monitor my juniper logs. I tried severals apps for juniper, but i got nothing. My juniper runs on junos. Could you give me the requisite app, and the documentation ?? thank you ... View more