I have installed splunk forwarder in the same machine where splunk is installed.i need to know is that correct?or i need to install the forwarder in a different machine from where the splunk should pick the data or to monitor the data?pls help
The Splunk forwarder package is a subset of the Splunk package, installed into a different directory, so adding the forwarder is redundant since the installed Splunk package can do all of the file monitoring that the forwarder does. I would be surprised if you can have them both running at the same time.
If you make the relevant configuration changes you could run them on the same machine at the same time, but the use-cases for this are pretty minimal. In most instances you're better off configuring the indexer to index and forward.
Normally, the Splunk Universal Forwarder is used to consolidate machine data from remote machines, collecting and forwarding information to a Splunk Instance (in a sense of centralization).
In case you are setting up a Forwarder on the same machine as Splunk Instance just for a test, it's pretty acceptable, but, this is not the case to apply in production.
There is a online Universal Forwarder manual which is pretty straightforward:
Give you a chance to read and understand more about that...