Deployment Architecture

What is easiest way for Installing forwarder for 1000+ hosts?

newSplunker
Explorer

 

 

I am new to Splunk and I am requested by my company to install and configure Splunk enterprise.

 

   I read  a lot of documents and searched the answers website regarding installing the forwarder in the devices, I didn't find the answer to the below question:

What is easiest way for Installing forwarder for 1000+ host? these hosts include (Active directory, Linux Servers, windows Servers, Two different Firewalls, Laptops, Desktop PC...etc.)

 

  Will I need Admin account for these devices? As we disabled the root admin and we have specific admin for each device.

 

Your help is appreciated.

   

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

I forgot to mention, you will need administrator or root privileges for installations. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

newSplunker
Explorer

That means I should request three different admin right:

 One for creating and sending the scripts to Windows hosts.

Second for creating and sending the scripts to Linux hosts.

and the third one for syslog server.  

 

Am I correct?

0 Karma

scelikok
SplunkTrust
SplunkTrust

It really depends your infrastructure, unfortunately I can not know. 

I meant the admin/root password for running installation scripts on hosts. 

Sending scripts to hosts and installing syslog server are totally different processes. You should work with your system team.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

newSplunker
Explorer

 

Thanks for your quick response scelikok

 

What about the authorities that I need to perform this task: 

"  Will I need Admin account for these devices? As we disabled the root admin and we have specific admin for each device."

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @newSplunker,

The easiest way to install for clients is create an installation script that has deploymentclient setting in it, test it on some clients than distribute the script via configuration management system. On windows SCCM or GPO , on Linux RedHat Satellite or Ansible etc can be used. You should create two different scripts for Windows and Linux operating systems.

Firewalls and network devices likely send the logs via syslog, the best practice is installing a syslog server, write logs into dynamic files than use file monitoring via Universal Forwarder. Or you can use Splunk Connect for Syslog (https://splunkbase.splunk.com/app/4740)

 

If this reply helps you an upvote is appreciated. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...