Hi Team / Community
can someone please help me , i need to stop admin users from uninstalling the universal forwarder agent ?
how do i achieve this ? please help!
And dont anything about RBAC thats another story line .................
i think your question belongs to the people relationship page ...
maybe you should talk to them?
explain them why shouldnt they remove the forwarders?
maybe give them a nice demo of splunk and some value you extracted form the data you are now missing because they uninstalled your forwarder?
you can also have a job that installs your forwarders every hour, in that case, if its uninstalled, your job will re-install the forwarder!