I am currently successfully forwarding data of a created index from a sender to a receiver, the issue is I have created a new index with data inputs at the sender and I have configured all the correct inputs indexes confs and restarted both splunk servers and forwarders, The other index is coming through just fine, but the newly added one will not even budge through, I have spent the last 7 hours debugging and searching through the splunk logs for conf bugs or connection issues or even firewall problems which I doubted but checked anyway, in other words if the first index is working then there aren't any forwarder issues.
I cant think of anywhere else to check or debug any more, Any ideas?
I managed to fix the issue, but I have no idea how I did it, it just worked, must've been a typo somewhere.
I think the issue was that one of the Data Inputs had a "/*" at the end in inputs.conf which was confusing it, removing this I assume was the reason for it to finally work.
can you paste your inputs.conf from forwarder and indexes.conf from indexer?
As well did you see anything in indexer splunkd.log and forwarder splunkd.log?
I managed to fix the issue, but I have no idea how I did it, it just worked, must've been a typo somewhere.