I need to forward some database related logs into splunk indexer using scripted inputs (Shell scripts)
My questions are :
1)Do I need to install the universal forwarder in the host side ?
2) If the scripts are present in a location of host in likewise path below /splunkfwd/splunkforwarder/etc/apps/My_app/bin
Does that mean a universal forwarder is installed in it (Host)?
3)Is there any other way rather than installing UF in host that we can extract the logs into indexer using scripted inputs?
4)In order to accomplish this what are the steps do I need to follow ?
You could be better served by using HEC (Agentless Inputs) WITHOUT using UFs (works well with automation scripts).
HEC uses a token-based authentication model. You can generate a token and then configure a logging library or HTTP client with the token to send data to HEC in a specific format. This process eliminates the need for a Splunk forwarder when you send application events.