Universal Forwarder not sending monitor after installing Splunk App for Windows Infrastructure

[tbrown]

I installed the Splunk App for Windows Infrastructure using the following Splunk guide: https://docs.splunk.com/Documentation/MSApp/2.0.1/MSInfra/AbouttheSplunkAppforMSInfrastructure. I set up my the Splunk deployment server on my Splunk Enterprise Instance. For some reason, the Splunk Forwarder that I set up to be a client of this server is no longer sending the logs from the monitor that I defined in C:\Program FIles\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf. 

The Splunk Windows Add-on and the Splunk App for Windows Infrastructure is working correctly and is sending the Windows logs to the deployment server. 

I believe I need to change something in the setting of the deployment server/clients/server class to get my monitor to send the logs to the "main" index but I don't know what to change.

[anilchaithu]

@tbrown 

This has nothing to do with the app.

Please check the below.

1) Can you please check whether the role that run splunkd has access to the data to be monitored.

2) Does the client is forwarding internal logs to the main splunk instance. index=_internal host="client"

3) Does the client communicating to the deployment server? settings -> forwarder management

4) if all the above checks out, please look for errors in the splunkd logs on the client .

[tbrown]

Some more information, when I do ./splunk list monitor on both the Splunk instance and the forwarder, the correct directories show up so they are recognized as inputs. I think the issue is therefore related to how I configured the "Universal Forwarders" server class or my clients in the deployment server.