Hi Krashev,
For you I'd really consider installing the *nix app and understanding the way it collects, forwards, and presents data. Once you've got a solid grasp of this, here's some instructions I gave to someone else as part of THIS answer.
Download the *nix app and install it on a full test Splunk installation on one of your Unix servers.
Configure the files you would like your forwarders to send into Splunk (you can either do this via the web GUI or through the config files if you're happy to do that)
Create a test index on your Splunk Indexer (eg. unix_test)
Configure your forwarder to send events to your Indexer with 'unix_test' as the target index.
Confirm that the events are coming through correctly, with the timestamp, host, source & sourcetypes what you expect them to be.
Once you're happy with all of the above, change the target index back to your default index, zip/tarball up the $SPLUNK_HOME/etc/apps/unix/ directory, then deploy this to your environment.
Remove the test index.
Now you'll have a *nix app that has been configured specifically for your environment.
If you've got a lot of servers, I'd recommend using a Deployment Manager, but the steps above are a fairly high-level summary of where I think you want to get to.
Hope this helps!
