Do I need a universal forwarder

[rcon313]

Hi guys,

I am very new to Splunk and this is only my first week using it. What I am wanting to do is view the performance logs of my own local machine and then put it into a dashboard. It would also be good to be able to get the number of times I have logged into my laptop if that is possible. The questions is, Do I need to use a universal forwarder to be able to do all this ? I am not sure, from what I have read online the universal forwarder is used for remote machines but because its local would I need to use one. I can imagine this being a very noobie question but need the help if someone is able to.

Thank You

[SanjayReddy]

Hi @rcon313 

you can install Splunk enterpirse  on you localhost for colleting logs and creating dashboard.

Splunk enterpirse work as single package which can ingest the data , store the data , and searhch the data for your localhost, you can use this software for 60 days free trail .


link to download

https://www.splunk.com/en_us/download/splunk-enterprise.html

after steup you can access splunk on http://localhost:8000/ 

stpes to moniotr your local system data

[rcon313]

Thank you very much 

[SanjayReddy]

@rcon313 

if you found reply is helpfull, please accept it as solution