My local Universal Forwarder to AWS Splunk Instance

[tentontitan]

I have a splunk instance running on Amazon AWS for testing. I'm trying to configure my home pc to forward (universal forwarder) to the AWS Splunk instance.

So far I'm not seeing anything. My AWS instance is on 1.2.3.4 (fake obviously). And my computers outputs.conf is:

[tcpout]
defaultGroup = group1

[tcpout:group1]
server = 1.2.3.4:9997

I'm not sure if there is anything else I should be doing. My router is allowing traffic on 9997. I can hit the web interface - 1.2.3.4:8000. I'm not sure what is happening.

[gjanders]

If you have setup the outputs.conf the _internal data should start going through, so you should be able to search the _internal index for the host sending the data.

Does telnet work to connect to port 9997 on the remote address?
I'm assuming the remote side is listening on port 9997...