Do we need to install the Universal forwarder in the host(Log originating Server) for scripted inputs?

[raj_mpl]

Hi All,

I need to forward some database related logs into splunk indexer using scripted inputs (Shell scripts)
My questions are :

1)Do I need to install the universal forwarder in the host side ?
2) If the scripts are present in a location of host in likewise path below
/splunkfwd/splunkforwarder/etc/apps/My_app/bin
Does that mean a universal forwarder is installed in it (Host)?
3)Is there any other way rather than installing UF in host that we can extract the logs into indexer using scripted inputs?
4)In order to accomplish this what are the steps do I need to follow ?

[richgalloway]

1) To run a scripted input you need either a Universal Forwarder or a Heavy Forwarder. You'll need the HF to run a Python script.

2) Most likely, yes.

3) See @mguhad's answer.

4) See http://docs.splunk.com/Documentation/Forwarder/7.2.1/Forwarder/Abouttheuniversalforwarder

[mguhad]

You could be better served by using HEC (Agentless Inputs) WITHOUT using UFs (works well with automation scripts).

HEC uses a token-based authentication model. You can generate a token and then configure a logging library or HTTP client with the token to send data to HEC in a specific format. This process eliminates the need for a Splunk forwarder when you send application events.

More details can be found here: https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector