Why do I see my data at the forwarder, but not at the indexer?

[pfabrizi]

I am trying to trouble shoot a data flow issue I am having. I see the data coming into my forwarder but I don't see it at the indexer.
Is this a log file I can check?
can I run a tcpdump on either forwarder or indexer to see if the data is being sent out or received ?

Thanks!

[s2_splunk · Accepted solution]

I would recommend you work through the documentation here and if nothing helps, go to more drastic means. 😉