Deployment Architecture

What is easiest way for Installing forwarder for 1000+ hosts?

newSplunker
Explorer

 

 

I am new to Splunk and I am requested by my company to install and configure Splunk enterprise.

 

   I read  a lot of documents and searched the answers website regarding installing the forwarder in the devices, I didn't find the answer to the below question:

What is easiest way for Installing forwarder for 1000+ host? these hosts include (Active directory, Linux Servers, windows Servers, Two different Firewalls, Laptops, Desktop PC...etc.)

 

  Will I need Admin account for these devices? As we disabled the root admin and we have specific admin for each device.

 

Your help is appreciated.

   

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

I forgot to mention, you will need administrator or root privileges for installations. 

If this reply helps you an upvote is appreciated.

newSplunker
Explorer

That means I should request three different admin right:

 One for creating and sending the scripts to Windows hosts.

Second for creating and sending the scripts to Linux hosts.

and the third one for syslog server.  

 

Am I correct?

0 Karma

scelikok
SplunkTrust
SplunkTrust

It really depends your infrastructure, unfortunately I can not know. 

I meant the admin/root password for running installation scripts on hosts. 

Sending scripts to hosts and installing syslog server are totally different processes. You should work with your system team.

If this reply helps you an upvote is appreciated.

newSplunker
Explorer

 

Thanks for your quick response scelikok

 

What about the authorities that I need to perform this task: 

"  Will I need Admin account for these devices? As we disabled the root admin and we have specific admin for each device."

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @newSplunker,

The easiest way to install for clients is create an installation script that has deploymentclient setting in it, test it on some clients than distribute the script via configuration management system. On windows SCCM or GPO , on Linux RedHat Satellite or Ansible etc can be used. You should create two different scripts for Windows and Linux operating systems.

Firewalls and network devices likely send the logs via syslog, the best practice is installing a syslog server, write logs into dynamic files than use file monitoring via Universal Forwarder. Or you can use Splunk Connect for Syslog (https://splunkbase.splunk.com/app/4740)

 

If this reply helps you an upvote is appreciated. 

If this reply helps you an upvote is appreciated.
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...