Hello, I have a working Splunk Enterprise and Splunk Universal Forwarder. I am using 2 different CentOS VM Instance. I can successfully forward logs from UF to SE. I can also do search in here. Although I wanted to do metrics using Splunk App for infrastructure. I'm quite new to splunk and kind of a bit confused on this part of installation.
I installed Splunk App in SE, then installed the Add-on on both SE and UF. I tried the automatic installed using the generated linux command but unfortunately, after downloading that.. my SE Entities are still empty. I've been trying these so many times so now I'm just trying to install in manually.
I am following this: https://docs.splunk.com/Documentation/InfraApp/2.0.3/Admin/ManualInstalLinuxUF. Although I wanted to ask if I need to install again a separate UF from this SAI basing from step 1? or the previous step that I did is already enough? (My currently working SE and UF).
Furthermore, where should I alter the inputs.conf and outputs.conf? Should it be in the existing UF, additional UF or to the existing SE?
I've been struggling with this for quite some time now.. thank you in advance for any help!
