Setting up AD Monitor - New to Splunk

[smartkid808]

Hi.  I am new to splunk and testing it in lab right now, seeing if it will work for us.   Some of the docs are a little confusing, so want to make sure I am understanding things right

What I need to monitor is Events from all servers, AD Changes/Lockouts.  Maybe Fortinet Logs as well.  Hoping to use splunk for AD Monitoring, and stop paying Netwrix.  

Trying to determine how much data would be needed for ingestion.  Is ingestion for only importing of data, or does is it also used in processing that Splunk does?

I currently have the Windows add-on installed in my instance. My first part of testing is this.

1. Get logs from servers, do I still need to configure the inputs file in the default directory, enabling ADMON?

2. AD Change monitoring, Same as above, do I need to enable it there, or do I just set it up in the AD tab under settings->inputs?

TIA for your help!

-Will

[smartkid808]

Also, Do I need to install the universal forwarder on all servers?