We are looking at a pilot project to use Splunk to help manage our desktop inventory using the Microsoft_windows_TA add-on and a universal forwarder installed on the desktops.
The only information we will be extracting at this time is the Windows host information: System Name, OS, IP address, and logged-on user.
We are wondering how we can set up the universal forwarders on the desktops so that when they phone home to the deployment server, and we access the forwarder management page under settings (Settings>forwarder Management), we can segregate the desktops from the universal forwarders currently on the servers, if this is possible that is?
Just wondering if there was an easy way to do this so there are not pages and pages of desktops and servers phoning home making it hard to separate the two when accessing the forwarder management page.
We are a small shop therefore no clustering.
Any guidance would be appreciated.