If you are not able to see any logs on the Splunk search head, the possible issue can be,
Firstly, If you have followed every step to set up a forwarder then probably you would have completed the first step.
Secondly, you need to check the forward-server status of your Splunk forwarder using the below-given command,
splunk list forward-server
It will show the list of forward-servers configured and they will be categorized under two categories "Active forwards" and "Configured but inactive forwards".
If your forward-server is listed under the latter then, you should check your Splunk forwarder's logs to find out the particular reason.
- The log file is stored under /var/log/splunk/splunkd.log
If you see any error you can post it here, so that we can help you with that too.
You can find more information related to universal forwarder setup at the below link,
Hope it helps.
What you need to do is some properly structured troubleshooting. If you want help with that, the only way to get that is by sharing the relevant configurations (masking confidential info where needed) and providing a lot more info on what your setup looks like.
Also take a look at the troubleshooting guide: https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata
Just saying "it doesn't work", "what should I do" makes it very difficult for anyone to help. Functioning crystal balls are still very rare 😉