https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-universal-forwarder-not-pushing-data-to/m-p/241045#M46789 <P>I recently upgraded a workstation to Win10 Enterprise. I installed the Splunk universal forwarder, however I am not collecting any data from the workstation at the indexer. I believe it has something to do with certificates, but I am not very well versed in the product. I'm afraid the documentation isn't helping much either. </P> Wed, 18 Jan 2017 00:57:56 GMT jpbelauskas1 2017-01-18T00:57:56Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-universal-forwarder-not-pushing-data-to/m-p/241045#M46789 <P>I recently upgraded a workstation to Win10 Enterprise. I installed the Splunk universal forwarder, however I am not collecting any data from the workstation at the indexer. I believe it has something to do with certificates, but I am not very well versed in the product. I'm afraid the documentation isn't helping much either. </P> Wed, 18 Jan 2017 00:57:56 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-universal-forwarder-not-pushing-data-to/m-p/241045#M46789 jpbelauskas1 2017-01-18T00:57:56Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-universal-forwarder-not-pushing-data-to/m-p/241046#M46790 <P>So the forwarder worked on a previous version of Windows but is not working after upgrading to Win10? </P> <P>Can you check your <CODE>outputs.conf</CODE> under <CODE>SPLUNK_HOME\etc\system\local</CODE> and verify its pointing to the correct indexer(s)? </P> <P>If it is, you should then go to <CODE>SPLUNK_HOME\etc\var\log\splunk</CODE> and open up <CODE>splunkd.log</CODE> and see if its complaining about anything </P> Wed, 18 Jan 2017 02:19:08 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-Splunk-universal-forwarder-not-pushing-data-to/m-p/241046#M46790 skoelpin 2017-01-18T02:19:08Z