Install a universal forwarder on each Windows server

To get data from the Windows servers into the Splunk App for Windows Infrastructure, you must install a Splunk universal forwarder onto each Windows server in your environment, place the relevant Splunk App for Windows Infrastructure add-ons into the forwarder, and configure the forwarders to send data to the central Splunk instance in the Splunk App for Windows Infrastructure deployment.

To install a universal forwarder onto each Windows server, follow the steps located in one of these topics in the core Splunk Enterprise documentation:

• "Deploy a Windows universal forwarder from the installer GUI" or
• "Deploy a Windows universal forwarder from the command line"

Once you've installed the universal forwarders, you can proceed to deploying the relevant Splunk App for Windows Infrastructure add-ons to each one, depending on what the server does.

For more information about distributed deployments and how to deploy universal forwarders, read "Universal forwarder deployment overview" in the core Splunk Enterprise documentation.