I do this infrequently enough that I decided I should really write this down. Below is the quick and dirty way to get the Splunk universal forwarder installed on a new Linux system. Thanks to byteschef for the information used to create this guide.
Download the latest splunk .RPM from their site and install it via RPM -i <filename> (if RedHat based) or dpki -i <filename> if debian based.
Run the following commands as root:
cd /opt/splunkforwarder/bin ./splunk start --accept-license ./splunk enable boot-start ./splunk add forward-server <IP/hostname of splunk server>:9997 -auth admin:changeme ./splunk add monitor /var/log ./splunk edit user admin -password NEW_PASSWORD -auth admin:changeme ./splunk restart
If there are any other directories you want monitored other than /var/log (application logs, for example) then issue:
./splunk add monitor <directory to monitor>