What system logs are needed to deploy Splunk effectively and cover the SANS top 20? Need to determine where to deploy forwarders

Hi I am deploying Splunk in an environment and would like to capture as many security aspects from the SANS top 20 as possible. I am not too technical, so I am hoping someone will be able to help me determine what type of logs I will actually need access to so I know where to deploy my forwarders.