All Apps and Add-ons

Do we need to install the Universal forwarder in the host(Log originating Server) for scripted inputs?

raj_mpl
Path Finder

Hi All,

I need to forward some database related logs into splunk indexer using scripted inputs (Shell scripts)
My questions are :

1)Do I need to install the universal forwarder in the host side ?
2) If the scripts are present in a location of host in likewise path below
/splunkfwd/splunkforwarder/etc/apps/My_app/bin
Does that mean a universal forwarder is installed in it (Host)?
3)Is there any other way rather than installing UF in host that we can extract the logs into indexer using scripted inputs?
4)In order to accomplish this what are the steps do I need to follow ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

1) To run a scripted input you need either a Universal Forwarder or a Heavy Forwarder. You'll need the HF to run a Python script.

2) Most likely, yes.

3) See @mguhad's answer.

4) See http://docs.splunk.com/Documentation/Forwarder/7.2.1/Forwarder/Abouttheuniversalforwarder

---
If this reply helps you, Karma would be appreciated.
0 Karma

mguhad
Communicator

You could be better served by using HEC (Agentless Inputs) WITHOUT using UFs (works well with automation scripts).

HEC uses a token-based authentication model. You can generate a token and then configure a logging library or HTTP client with the token to send data to HEC in a specific format. This process eliminates the need for a Splunk forwarder when you send application events.

More details can be found here: https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...