How to install splunk in 1000 EC2 instances

[VijaySrrie]

Hi,

We have 1000 EC2 instances, how to install forwarders in all instances all at one go?

If we use script, from where we need to push the forwarder config to all 1000 instances?

[Roy_9]

I would recommend an ansible script to automate this installation.

[isoutamo]

Hi

this depends what kind of instances those are and especially how those are created and managed. Options are e.g. use suitable commands in your cloudformation definition or terraform scripts or use e.g. ansible or other to to install and update those. Then @richgalloway propose use DS to manage configurations or ansible or other tool which your enterprise is already used. 
As you see there isn’t only one solution or even best practices (except automate it).
r. Ismo 

[richgalloway]

Consider installing the UF on one instance and the then cloning that instance 999 times.  See https://docs.splunk.com/Documentation/Forwarder/8.2.3/Forwarder/Makeauniversalforwarderpartofahostim...for details.

If you already have all of the instances defined, then it may be best to run a script that installs the UF remotely on each instance.  A good place to run the script is on your Deployment Server.  If you don't have a DS, then create one - it will make managing so many forwarders much easier.  See https://community.splunk.com/t5/Installation/Forwarder-Installation-Script/m-p/50690 and https://docs.splunk.com/Documentation/Forwarder/8.2.3/Forwarder/Installanixuniversalforwarderremotel...for sample scripts.