Getting Data In

Does a Splunk forwarder need to be installed a on a Splunk server to ingest its own logs? Or does the server automatically grab its own logs?

cipherboy123
New Member

Do I need to install a Splunk forwarder on a Splunk server to ingest its own logs?
Or does the server automatically grab its own logs?

0 Karma

edgarsilva01
Path Finder

No, if you want to monitor logs that live on the server where you have splunk installed it is not necessary to install the forwarder.
See a "configuration" "add data" "Monitor" and see the different options of how you can monitor the records.

Optional use "Local event logs" or "Files and directories" for this option you need the path where the logs you want to monitor are stored.

Regards

0 Karma

woodcock
Esteemed Legend

By default, Splunk splunks it's own Splunky junk, HOWEVER, it does not by default send to Indexers, which is very important to make happen for your Search Heads, DSs, MCs, CMs, Deployers and all other non-Indexer Splunk nodes.

adonio
Ultra Champion

no you dont need to install the forwarder where the splunk server is
configure your inputs as you see fit locally
read all the way through dos here:
https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Getstartedwithgettingdatain

0 Karma

jacobpevans
Motivator

It automatically ingests its own logs. Run a search for:

index=_* host=[your_splunk_host]

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

cipherboy123
New Member

Thanks, I searched my localhost through the dashboard but there were no longs that appeared from the host.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...