https://community.splunk.com/t5/Deployment-Architecture/Clients-as-forwarders/m-p/520946#M17927 <P>Hello,&nbsp;</P><P>Im a newbie and im tasked to figure out Splunk at my work site. I have Splunk Enterprise&nbsp; 5GB and around 200 users. Can make them all forwarders ?&nbsp;</P> Wed, 23 Sep 2020 01:10:14 GMT ari-001 2020-09-23T01:10:14Z https://community.splunk.com/t5/Deployment-Architecture/Clients-as-forwarders/m-p/520946#M17927 <P>Hello,&nbsp;</P><P>Im a newbie and im tasked to figure out Splunk at my work site. I have Splunk Enterprise&nbsp; 5GB and around 200 users. Can make them all forwarders ?&nbsp;</P> Wed, 23 Sep 2020 01:10:14 GMT https://community.splunk.com/t5/Deployment-Architecture/Clients-as-forwarders/m-p/520946#M17927 ari-001 2020-09-23T01:10:14Z https://community.splunk.com/t5/Deployment-Architecture/Clients-as-forwarders/m-p/520950#M17929 <P>First, I definitely recommend taking the <A href="https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html" target="_self">Splunk Fundamentals 1 class</A>. It's free and it gives you a good overview of all thing Splunk without making your head spin.</P><P>The answer to your question depends on your environment. 5G across 200 nodes will get tight if you want to see into everything. Take a look at this <A href="https://community.splunk.com/t5/Getting-Data-In/Is-it-recommended-to-install-a-universal-forwarder-on-thousands/m-p/265149" target="_self">question and answer that is similar to yours</A> for the pros and cons of going with 200 forwarders or a couple servers.</P><P>Hoped this helped!</P> Wed, 23 Sep 2020 02:23:20 GMT https://community.splunk.com/t5/Deployment-Architecture/Clients-as-forwarders/m-p/520950#M17929 96nick 2020-09-23T02:23:20Z