I've set up a universal forwarder on a remote webserver using local system account (Win2008R2 64bit).
I have enabled receiving on the receiver which is using a domain account (Win7 Pro 64bit). It asked to restart Splunk which I did.
The dashboard is now showing:
Error in 'DispatchProcess': Failed to write the info file to C:\Program Files\Splunk\var\run\splunk\dispatch\[lots of letters and numbers]\info.csv
↧