Can you use Splunk universal forwarder to forward data to Splunk Enterprise ran locally?

[denzelchung]

I am trying to get an Universal Forwarder installed on a server to forward some logs data to my Splunk Enterprise that is running on localhost (not hosted on any server).
Is this possible?
If I forward the data from the Universal Forwarder to my host's IP address and enable receiving, will it work?

[richgalloway]

If I understand the question correctly, you have Splunk Enterprise and Universal Forwarder running on the same server. This is not necessary. Splunk Enterprise can monitor files itself so there's no need for a forwarder on the same server.

[denzelchung]

Sorry if it is unclear. The Universal Forwarder is going to be installed on a different server and it is forwarding data to my laptop as a proof of concept.

[richgalloway]

Thanks for clarifying. You will need to enable Splunk on your laptop to receive data on port 9997 (default). Go to Settings->Forwarding and Receiving to do that. You'll probably need to open a hole in your firewall, too. Then put your laptop's IP address in the forwarder's outputs.conf file, restart, and you should see data.

[effem]

Depending on how your networking is set up and if the Splunk Instance on your machine is bind to your "external" IP.

However, it is not recommended to send data unsecured/unencrypted over the internet.