Forums: SplunkPreview: Service won't run as Windows Domain Account

Anytime I change the splunkd service in Windows to a Windows Domain login/pwd, it crashes. The service works fine when running as the local system account.

Running as local system account I cannot get WMI to pull down the Windows Event logs from another Windows machine.

Thanks,
-Matt

I am able to get Splunk to run as a domain user. How are you trying to configure it to start as your user? Does the user have the necessary rights to log on as a service account? Does it have rights on the remote systems?

When I try to install the server and put the domain user/pwd in during the installation process, it takes a long time and then proceeds. However, when it finishes the services are running as the local system.

When I change the services to a domain account after the install, the splunkd.exe service crashes.

-Matt

Weird thing is that the Splunk-web process will login as the domain account and stay up and the splunkd won't, it just crashes.

-Matt

That is bizarre. What rights do the domain account have on the box running splunk (i.e. what groups is it in)?

I am getting this same problem. I just downloaded the application for the first time. When logged in as a local system account, it works, but at a user, splunkd crashes. I am even trying it with the domain administrator (its just a test vm). Splunk-wb starts and runs just find, but it tells me that Splunkd appears to be down.

Reproduced and bug filed.

05142008 Version still has this bug

We can't fix bugs one week after we find them, give us a bit to fix, test, and QA :)

If you choose a domain account during the MSI installer process, it will run will run under the domain user context. If you choose local system during the MSI, you will not be able to change to a domain user unless you reinstall.

[Revised on Thu, 15 May 2008 07:58:42 -0700]

Also, keep in mind that the version you are referring to is a preview version. Think of it as an alpha, and expect it to have bugs. Don't hesitate to report them though :)

Same problem after upgrading to 3.3.1