Splunk implementation in a small Network of 25-30 computers

[kbang]

Hello ,
I am trying to collect logs from 25-30 computers in my local LAN network and learn how to use splunk .
I have installed a splunk universal forwarder in one of the Debain PC ( PC1 , from where i want to collect the logs ) and a Splunk server in another Debian machine (PC2 ) .
I am able to see the logs of PC1 in the server , create co-relation rules and set alerts and other things which i have been reading in the splunk documentation.

Can anyone Pls help me as to how will i install splunk universal or heavy forwarder in all 30 PCS in my LAN and start getting logs from all PCs. ?
Should i manually do it in every computer or is there a better way ?

[nickhills]

Do you have any deployment architecture or system management infrastructure?
If not, the best approach is to script it, and configure each of your universal forwarders to connect to a Splunk Deployment server.

[gcusello]

Hi @kbang,
At first you need only of Universal Forwarder, not of Heavy Forwarder.
The installation of Splunk Universal Forwarder is manual or using an external SW Distribution tool.

When the UF is installed on all your target servers, you can deploy configurations to all of them using a role of your Splunk Server: the Deployment Server (for more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Aboutdeploymentserver ).

In other words you have to create a set of Apps (called Technical Add-Ons) to deploy to all your server or a part of them.
e.g. at first, you could create a TA called TA_Forwarders containing only outputs.conf and deploymentclient.conf files: the first addresses the Splunk server to send logs and the second addresses the server that manages UFs configurations (in your test case is the same, usually are different servers).

Then you could use the Splunk-TA_Windows to ingest Windows logs.

Ciao.
Giuseppe