I am rolling out a trial instance of splunk enterprise, I have it running on a 2012r2 vm, and have installed the Universal Forwarder on two workstations pointing at it. My trouble is that I do not receive any data from the workstations. I have gone over the install/troubleshooting documentation several times but I feel like I'm missing something obvious, as the documentation seems to just assume that once you install the forwarder it should just work.
Do I need to make config changes on the server to support data input from the forwarder, or should they talk to eachother out of the box if the forwarder is pointed at the right IP?
Are there any youtube or other top to bottom no steps skipped idiot level tutorials I could follow through to find what I'm missing?
Thanks.
Also check out: http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata
Also check out: http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata
I removed and re-added the 9997 receiver and reinstalled the universal forwarder on the client and it looks like its working this time. Thanks for the help.