topic Can you give me some clarification on Monitoring _internal logs? in Getting Data In

Can you give me some clarification on Monitoring _internal logs?

EHariharan — Thu, 10 Jan 2019 12:41:28 GMT

Hi Everyone,

I am new to Splunk. Here I am having some clarification on monitoring _internal logs.

I do have 4 IDX, 2 SHD, DPL, DPM, Master. Am I able to monitor the logs from those instances without using a universal forwarder (UF)?

We could use the UF to forward logs, but Splunk advises us to use one instance in one server.

Please Advice!

richgalloway — Thu, 10 Jan 2019 13:43:30 GMT

All of your Splunk instances (except the indexers) should be forwarding their internal logs to your indexers. They have the ability to forward logs without a separate forwarder. See https://docs.splunk.com/Documentation/Splunk/7.2.3/DistSearch/Forwardsearchheaddata

EHariharan — Thu, 10 Jan 2019 14:26:32 GMT

Thank you Mr.Richgalloway

Did those instances forward the OS logs without UF?

richgalloway — Thu, 10 Jan 2019 22:48:28 GMT

Yes, they do, if you follow the instructions in the link.