Installing Splunk on Windows server

Installing Splunk Enterprise on Windows Server is fairly straightforward, but it does require some preparation in terms of deciding whether you're going to install it as a local system user or a member of your existing domain, in which case there are a number of considerations for access rights to directories and files. You will also need to know if you will collect data from remote Windows servers via Splunk universal forwarders and/or the Windows Management Instrumentation (WMI), as this will affect your decision as well. The Splunk Enterprise Installation Manual includes a section covering Windows installation that covers all of these factors; the discussion starts at this link: http://docs.splunk.com/Documentation/Splunk/7.1.1/Installation/ChoosetheuserSplunkshouldrunas.

As you read through the specifics in the installation manual, I suspect you will decide to run Splunk as a local system user, and use forwarders to collect remote data—a much more performant and simpler solution to install, manage, and troubleshoot. 

The documentation discusses a couple more factors we will touch on before getting started with the installation.