I'm trying to retrieve data from another server using a universal forwarder. I succeeded in installing the universal forwarder on the server, configured the correct IP address, and restarted Splunk. However, the system still indicates that my forwarder is inactive.
I've checked that the necessary ports are open, and there are no firewall issues. No problems with output/inputs as well. I've tried all the troubleshooting after searching through the forum, but to avail.
How do I "activate" the forwarder?
We see in the screen-shot Configured but inactive forwards ...
Very good explanation at -
How to activate forward-server?
