Help configuring a domain controller on a universal forwarder to send data to indexer

[rahulkumarfgf]

Hello Guys,
I am very new to Splunk and am trying to configure UF to send data to an indexer on port 9997. I have enabled the receiver in indexer instance. I have added [tcp://....DC IP Address:9997] and index = indexname in the inputs.conf file for UF found in $SPLUNK_HOME$/etc/system/local. I restarted splunkd services but am not getting any data coming to the specified indexer. The firewalls are OFF on the server. Indexer and UF are installed on the same server and this server is part of the domain controller. I apologize if I am not able to provide all the details as I do not have much understanding on it. Please let me know if you require any more information.

Also, when I try to stop splukd services, I get Error:1035 but the service stops and I can start it again.

Any help is much appreciated. Thank You!

[rahulkumarfgf]

As of now, we want to go with Windows deployment. And you are correct. It's not installed on the domain controller and I do plan to collect logs from the domain controller remotely.

I do not know what logs exactly we want but we do need to see any file changes being made, login/logout info, any network issues, etc.