Can I use splunk app for linux without installing universal forwarder on each linux host I need their logs?
you can use forwarding from syslog (rsyslog, syslogng etc) or as named above. i prefer fluentbit
The app is useless without the logs but certainly there are may ways to get them in. You can use the UF, snare, fluentd, to name just a few tools.
UF
snare
fluentd
If you are referring to Splunk Add-on for Linux then you could read the documentation around this for example configure collectd to send data
If you are using collectd on the remote machines you would not need a universal forwarder on each Linux machine.
