Why is no data being indexed after installing Splunk, universal forwarder and 3 applications?

[adamswebsiteacc]

Hey All,
I am very new to Splunk. I have installed my first Splunk server/index/deployment server on a single server and have also just installed the following applications:

Windows Infrastructure,

Splunk LDAP Support and

Splunk_TA_windows

As per the manual I configured and copied the relevant apps to my deployment-apps folder being:

SA-ModularInput-PowerShell,

Splunk_TA_windows,

TA-DNSServer-NT6 and

TA-DomainController-2012R2 as per my environment.

Having installed the universal forwarder on my first DC (Server 2012 r2) it has received the apps using the deployment server as expected. Looking at the splunk and metrics log on my forwarder I can see I am connected to the splunk server on 9997 and events are listed in metrics.log however my indexer shows that all non-internal indexes are empty. Looking at the metrics log on the indexer I can see this log has already rolled a number of times and shows events from DC.

I have checked the inputs.conf in Splunk_TA_windows and confirmed the items I am interested in are enabled as a starting point. Any suggestions on what I should be looking at next?

[NaorP]

If you are using a Splunk heavy forwarder and not a single box make sure that you enabled Receiving of data onto your splunk indexer.
head to Settings -> Forwarding and receiving -> Configure receiving -> New -> Than add 9997.

If you are using a single box installation that connects directly to the DC server than head to Settings -> Data inputs -> and make sure you are listening to the data flow from the universal forwarder.

[NaorP]

Hi,
I understand but what is still not clear to me is what exactly is your architecture. IF you are using a single box deployment (as you suggested with search head+indexer+deployment server) than port 9997 is not for you (it is used only in cases of a splunk heavy forwarder transferring data to the splunk indexer).
You will need to add an input for Windows Event Log collection.
Go to Settings -> Data inputs -> Add Data -> Windows Event Log Collection.

Best regards,
Naor

[adamswebsiteacc]

Thanks for the response however as mentioned in my initial question I can see the connection on 9997 and the port is configured and listening. I used the Settings -> Forwarding and Receiving -> Configure Receiving -> New -> TCP 9997