All Apps and Add-ons

Does the account that the Splunk service uses require interactive logon rights to execute scripts?

rbaker_isc
Engager

We have SOS and the Windows Infrastructure apps installed. Just curious if the scripts are executed by the Splunk Search server remotely on the target systems, or by the UF on the target systems? Either way, does the account the Splunk service is started with require interactive logon rights to execute scripts?

1 Solution

hexx
Splunk Employee
Splunk Employee

So, I'm going to assume you are talking about scripted inputs (as opposed to custom search commands, for example).

As far as S.o.S is concerned, these scripted inputs (and on Windows there is only one, really: ps_sos.ps1) runs locally and collects resource usage information about Splunk processes running on the local machine only.

If you want to benefit from the same level of information from forwarders or from your indexers, you'll need to install the S.o.S add-on for Windows there.

With that in consideration, interactive logon permissions are not in scope of course, but the execution of unsigned Powershell scripts is.

For more information on all of this, please consult the S.o.S User Manual.

View solution in original post

hexx
Splunk Employee
Splunk Employee

So, I'm going to assume you are talking about scripted inputs (as opposed to custom search commands, for example).

As far as S.o.S is concerned, these scripted inputs (and on Windows there is only one, really: ps_sos.ps1) runs locally and collects resource usage information about Splunk processes running on the local machine only.

If you want to benefit from the same level of information from forwarders or from your indexers, you'll need to install the S.o.S add-on for Windows there.

With that in consideration, interactive logon permissions are not in scope of course, but the execution of unsigned Powershell scripts is.

For more information on all of this, please consult the S.o.S User Manual.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...