First time Newbie. I have 2 VMs running RHEL 7.4. Both are running the Splunk app. 1 is set for forwarding and 1 for receiving from within the app under "Settings". It looks like it's working but I also see references to Universal Forwarders. What is the best way to go? This is just for learning purposes.
To build on this, while "best" is an "it depends" provoking question, I want to share with you that when I first started playing with Splunk, I also started with the classic full Splunk Enterprise install. Only after learning more and understanding the differences in forwarder types was I able to make a more informed choice to switch to the Universal Forwarder.
So, there's nothing "wrong" with what you're doing. I suggest, as you get more comfortable, read some of this material to learn more about the choices you are able to make, should you choose to make them.