Setup Splunk in a new environment

[nswcowboy]

Hi Guys,
I am new to Splunk and need your input.
My company want to collect specific logs entries from different nodes:

• 100 servers
• 50 network devices
• 5 to 10 storage arrays

Questions:

1. what are the firewall ports that I need to open, and is it one way or bi-directional?
2. what is the best practice/method to get data from those nodes which include the data filtering?
3. Do I need to install forwarders and which type?

Thank you

[kristian_kolb]

1)
There are 3 types of network traffic going on, normally
a) log traffic from forwarder to indexer, one-way, default port tcp/9997 - but that is configurable.
b) intra-splunk communication. Default port tcp/8089 (configurable but don't)
- between Search Heads and Indexers, initiated by Search Heads.
- between Deployment Clients and Deployment Server. Initiated by the Deployment Client.
c) Web browser to splunkweb, default port 8000, configurable

Add anything you need for syslog (see below). Also, it's good to be able to connect to the splunk servers on ssh (tcp/22) - and possibly to the splunkd REST api on port 8089 - from the admin's workstation.

2)
Put forwarders on the servers.
Let the network devices send syslog to a syslog daemon. Let the syslog daemon write the incoming data to files. Have a forwarder monitor those files.
For the storage arrays, I'm not sure, but I think you'd do the same as with the network devices.

3)
Universal forwarders in most cases.

On hosts that will collect data from other systems (syslog daemon, or for executing data collection scripts) a Heavy Forwarder might be useful, since it will offload the main indexer of some tasks.

Hope this helps,

Kristian