These should help you get started
Distributed Splunk Architecture: http://docs.splunk.com/Documentation/Splunk/6.2.2/Deploy/Distributedoverview
Indexer configuration
Index Creation: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setupmultipleindexes
Props entries/sourcetype definition: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Createsourcetypes
Forwarder configuration
Outputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Configureforwarderswithoutputs.confd
Inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Editinputs.conf
... View more