What is easiest way for Installing forwarder for 1000+ hosts?

[newSplunker]

I am new to Splunk and I am requested by my company to install and configure Splunk enterprise.

   I read  a lot of documents and searched the answers website regarding installing the forwarder in the devices, I didn't find the answer to the below question:

What is easiest way for Installing forwarder for 1000+ host? these hosts include (Active directory, Linux Servers, windows Servers, Two different Firewalls, Laptops, Desktop PC...etc.)

  Will I need Admin account for these devices? As we disabled the root admin and we have specific admin for each device.

Your help is appreciated.

[scelikok]

I forgot to mention, you will need administrator or root privileges for installations. 

[newSplunker]

That means I should request three different admin right:

 One for creating and sending the scripts to Windows hosts.

Second for creating and sending the scripts to Linux hosts.

and the third one for syslog server.  

Am I correct?

[scelikok]

It really depends your infrastructure, unfortunately I can not know. 

I meant the admin/root password for running installation scripts on hosts. 

Sending scripts to hosts and installing syslog server are totally different processes. You should work with your system team.

[newSplunker]

Thanks for your quick response scelikok

What about the authorities that I need to perform this task: 

"  Will I need Admin account for these devices? As we disabled the root admin and we have specific admin for each device."

[scelikok]

Hi @newSplunker,

The easiest way to install for clients is create an installation script that has deploymentclient setting in it, test it on some clients than distribute the script via configuration management system. On windows SCCM or GPO , on Linux RedHat Satellite or Ansible etc can be used. You should create two different scripts for Windows and Linux operating systems.

Firewalls and network devices likely send the logs via syslog, the best practice is installing a syslog server, write logs into dynamic files than use file monitoring via Universal Forwarder. Or you can use Splunk Connect for Syslog (https://splunkbase.splunk.com/app/4740)

If this reply helps you an upvote is appreciated.