Where do I find the logs of a universal forwarder that are installed in a domain controller?

[pramach]

Where do I find the logs of a universal forwarder that are installed in a domain controller?

We have universal forwarder installed in domain controller bu the logs for password change attempts are seen in the Domain controller but not in Splunk search head.
Please help to check if the universal forwarder has pushed the logs for password change attempt to the indexer/ heavy forwarder.

[aaraneta_splunk]

@pramach - Did the answer provided by woodcock help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

[woodcock]

I assume that you are using the TAs, which is great, but there is still admin to do. The most common mistake is that you have not created the index that is used in the inputs.conf. Any index that is used must be created in indexes.conf AND on your filesystem on each of your indexers. Your error logs will be flooded with logs complaining about this, if this is your problem.

[somesoni2]

Have you configured your universal forwarders (assuming it's on windows) to monitor (and send ) the event logs ?

[pramach]

Yes..We have configures