topic Re: Does a Splunk forwarder need to be installed a on a Splunk server to ingest its own logs? Or does the server automatically grab its own logs? in Getting Data In

Does a Splunk forwarder need to be installed a on a Splunk server to ingest its own logs? Or does the server automatically grab its own logs?

cipherboy123 — Mon, 04 Nov 2019 17:26:23 GMT

Do I need to install a Splunk forwarder on a Splunk server to ingest its own logs?
Or does the server automatically grab its own logs?

Re: Does a Splunk forwarder need to be installed a on a Splunk server to ingest its own logs? Or does the server automatically grab its own logs?

jacobpevans — Mon, 04 Nov 2019 17:51:00 GMT

It automatically ingests its own logs. Run a search for:

index=_* host=[your_splunk_host]

Re: Does a Splunk forwarder need to be installed a on a Splunk server to ingest its own logs? Or does the server automatically grab its own logs?

adonio — Mon, 04 Nov 2019 17:51:17 GMT

no you dont need to install the forwarder where the splunk server is
configure your inputs as you see fit locally
read all the way through dos here:
https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Getstartedwithgettingdatain

Re: Does a Splunk forwarder need to be installed a on a Splunk server to ingest its own logs? Or does the server automatically grab its own logs?

cipherboy123 — Mon, 04 Nov 2019 18:37:18 GMT

Thanks, I searched my localhost through the dashboard but there were no longs that appeared from the host.

Re: Does a Splunk forwarder need to be installed a on a Splunk server to ingest its own logs? Or does the server automatically grab its own logs?

woodcock — Mon, 04 Nov 2019 18:50:46 GMT

By default, Splunk splunks it's own Splunky junk, HOWEVER, it does not by default send to Indexers, which is very important to make happen for your Search Heads, DSs, MCs, CMs, Deployers and all other non-Indexer Splunk nodes.

Re: Does a Splunk forwarder need to be installed a on a Splunk server to ingest its own logs? Or does the server automatically grab its own logs?

edgarsilva01 — Tue, 05 Nov 2019 16:25:47 GMT

No, if you want to monitor logs that live on the server where you have splunk installed it is not necessary to install the forwarder.
See a "configuration" "add data" "Monitor" and see the different options of how you can monitor the records.

Optional use "Local event logs" or "Files and directories" for this option you need the path where the logs you want to monitor are stored.

Regards