https://community.splunk.com/t5/Getting-Data-In/Splunk-implementation-in-a-small-Network-of-25-30-computers/m-p/462815#M79884 <P>Do you have any deployment architecture or system management infrastructure? <BR /> If not, the best approach is to script it, and configure each of your universal forwarders to connect to a Splunk Deployment server. </P> Thu, 06 Feb 2020 14:18:30 GMT nickhills 2020-02-06T14:18:30Z https://community.splunk.com/t5/Getting-Data-In/Splunk-implementation-in-a-small-Network-of-25-30-computers/m-p/462813#M79882 <P>Hello , <BR /> I am trying to collect logs from 25-30 computers in my local LAN network and learn how to use splunk . <BR /> I have installed a splunk universal forwarder in one of the Debain PC ( PC1 , from where i want to collect the logs ) and a Splunk server in another Debian machine (PC2 ) . <BR /> I am able to see the logs of PC1 in the server , create co-relation rules and set alerts and other things which i have been reading in the splunk documentation. </P> <P>Can anyone Pls help me as to how will i install splunk universal or heavy forwarder in all 30 PCS in my LAN and start getting logs from all PCs. ? <BR /> Should i manually do it in every computer or is there a better way ? </P> Thu, 06 Feb 2020 07:35:37 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-implementation-in-a-small-Network-of-25-30-computers/m-p/462813#M79882 kbang 2020-02-06T07:35:37Z https://community.splunk.com/t5/Getting-Data-In/Splunk-implementation-in-a-small-Network-of-25-30-computers/m-p/462814#M79883 <P>Hi @kbang,<BR /> At first you need only of Universal Forwarder, not of Heavy Forwarder.<BR /> The installation of Splunk Universal Forwarder is manual or using an external SW Distribution tool.</P> <P>When the UF is installed on all your target servers, you can deploy configurations to all of them using a role of your Splunk Server: the Deployment Server (for more infos see at <A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Aboutdeploymentserver">https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Aboutdeploymentserver</A> ).</P> <P>In other words you have to create a set of Apps (called Technical Add-Ons) to deploy to all your server or a part of them.<BR /> e.g. at first, you could create a TA called TA_Forwarders containing only outputs.conf and deploymentclient.conf files: the first addresses the Splunk server to send logs and the second addresses the server that manages UFs configurations (in your test case is the same, usually are different servers).</P> <P>Then you could use the Splunk-TA_Windows to ingest Windows logs.</P> <P>Ciao.<BR /> Giuseppe</P> Thu, 06 Feb 2020 14:18:12 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-implementation-in-a-small-Network-of-25-30-computers/m-p/462814#M79883 gcusello 2020-02-06T14:18:12Z https://community.splunk.com/t5/Getting-Data-In/Splunk-implementation-in-a-small-Network-of-25-30-computers/m-p/462815#M79884 <P>Do you have any deployment architecture or system management infrastructure? <BR /> If not, the best approach is to script it, and configure each of your universal forwarders to connect to a Splunk Deployment server. </P> Thu, 06 Feb 2020 14:18:30 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-implementation-in-a-small-Network-of-25-30-computers/m-p/462815#M79884 nickhills 2020-02-06T14:18:30Z