How to use forwarder

[balajsoz]

Hi,
I have installed splunk forwarder in the same machine where splunk is installed.i need to know is that correct?or i need to install the forwarder in a different machine from where the splunk should pick the data or to monitor the data?pls help

[wagnerbianchi]

Normally, the Splunk Universal Forwarder is used to consolidate machine data from remote machines, collecting and forwarding information to a Splunk Instance (in a sense of centralization).

In case you are setting up a Forwarder on the same machine as Splunk Instance just for a test, it's pretty acceptable, but, this is not the case to apply in production.

There is a online Universal Forwarder manual which is pretty straightforward:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Introducingtheuniversalforwarder

Give you a chance to read and understand more about that...

Cheers, WB

[Wilcooley · Accepted solution]

The Splunk forwarder package is a subset of the Splunk package, installed into a different directory, so adding the forwarder is redundant since the installed Splunk package can do all of the file monitoring that the forwarder does. I would be surprised if you can have them both running at the same time.

[Drainy]

If you make the relevant configuration changes you could run them on the same machine at the same time, but the use-cases for this are pretty minimal. In most instances you're better off configuring the indexer to index and forward.