Hi, thanks again for your answer.
Sorry, but just to be clear : Is that mandatory to use deployment server ?
Because currently, I have 3 forwarders on 3 remote machine. As you say, it was a PoC but it's become a pilote and for security reason the user allowing connection when I do :
[host /]$ sudo /opt/splunkforwarder/bin/splunk add forward-server ip:port -auth admin:changeme
in my remote machine is my admin account.
If i create in Splunk web interface an user with the same role as admin (all the roles), and i try again on my remote server to add forwarder server :
[host /]$ sudo /opt/splunkforwarder/bin/splunk add forward-server ip:port -auth juliette:juliette
Then login failed. While nothing is different between admin user and juliette user.
I'm not sure that i explain well my problem, maybe it's my english or maybe i don't understand something in splunk configurations.
Another time,
Thanks a lot.
Regards,
Juliette
... View more