I'm becoming a big fan of Deployment Server for splunk configs. The only reason I might use puppet instead would be if the configuration is drastically different for each or groups of the forwarders. Otherwise, blast them all with the same stuff. Just my 2 pennies. ... View more

I am doing something similar at my company. There isn't a whole lot of setup necessary, really. Here's a bit of my inputs.conf [tcp://33333] disabled = false connection_host = dns index = foo sourcetype = bar You can find more config in the docs for inputs.conf Other than that, it pretty much works. Hope this helps. ... View more