Hi!
It was running as "Local System". I created "splunkforwarder" with local admins and log rights. At first I didn't get anything special so I made some Group Policy checks and left for home. During the night logs have started to come to indexer. Might've been a policy issue...?
Thanks for your help! 😃
... View more