Does a Splunk forwarder need to be installed a on a Splunk server to ingest its own logs? Or does the server automatically grab its own logs?

[cipherboy123]

Do I need to install a Splunk forwarder on a Splunk server to ingest its own logs?
Or does the server automatically grab its own logs?

[edgarsilva01]

No, if you want to monitor logs that live on the server where you have splunk installed it is not necessary to install the forwarder.
See a "configuration" "add data" "Monitor" and see the different options of how you can monitor the records.

Optional use "Local event logs" or "Files and directories" for this option you need the path where the logs you want to monitor are stored.

Regards

[woodcock]

By default, Splunk splunks it's own Splunky junk, HOWEVER, it does not by default send to Indexers, which is very important to make happen for your Search Heads, DSs, MCs, CMs, Deployers and all other non-Indexer Splunk nodes.

[adonio]

no you dont need to install the forwarder where the splunk server is
configure your inputs as you see fit locally
read all the way through dos here:
https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Getstartedwithgettingdatain

[jacobpevans]

It automatically ingests its own logs. Run a search for:

index=_* host=[your_splunk_host]

[cipherboy123]

Thanks, I searched my localhost through the dashboard but there were no longs that appeared from the host.