https://community.splunk.com/t5/Getting-Data-In/My-local-Universal-Forwarder-to-AWS-Splunk-Instance/m-p/292085#M55656 <P>If you have setup the outputs.conf the _internal data should start going through, so you should be able to search the _internal index for the host sending the data.</P> <P>Does telnet work to connect to port 9997 on the remote address?<BR /> I'm assuming the remote side is listening on port 9997...</P> Tue, 10 Oct 2017 11:40:41 GMT gjanders 2017-10-10T11:40:41Z https://community.splunk.com/t5/Getting-Data-In/My-local-Universal-Forwarder-to-AWS-Splunk-Instance/m-p/292084#M55655 <P>I have a splunk instance running on Amazon AWS for testing. I'm trying to configure my home pc to forward (universal forwarder) to the AWS Splunk instance.</P> <P>So far I'm not seeing anything. My AWS instance is on 1.2.3.4 (fake obviously). And my computers outputs.conf is:</P> <PRE><CODE>[tcpout] defaultGroup = group1 [tcpout:group1] server = 1.2.3.4:9997 </CODE></PRE> <P>I'm not sure if there is anything else I should be doing. My router is allowing traffic on 9997. I can hit the web interface - 1.2.3.4:8000. I'm not sure what is happening.</P> Tue, 10 Oct 2017 01:14:39 GMT https://community.splunk.com/t5/Getting-Data-In/My-local-Universal-Forwarder-to-AWS-Splunk-Instance/m-p/292084#M55655 tentontitan 2017-10-10T01:14:39Z https://community.splunk.com/t5/Getting-Data-In/My-local-Universal-Forwarder-to-AWS-Splunk-Instance/m-p/292085#M55656 <P>If you have setup the outputs.conf the _internal data should start going through, so you should be able to search the _internal index for the host sending the data.</P> <P>Does telnet work to connect to port 9997 on the remote address?<BR /> I'm assuming the remote side is listening on port 9997...</P> Tue, 10 Oct 2017 11:40:41 GMT https://community.splunk.com/t5/Getting-Data-In/My-local-Universal-Forwarder-to-AWS-Splunk-Instance/m-p/292085#M55656 gjanders 2017-10-10T11:40:41Z