I am able to gather Windows 2008 logs with no problems, but when I add a forwarder to a Windows 2003 box I get no logs. Any input?
Diego
Thank you for the quick response. I have validated that I am getting data by having the windowsupdate.log being sent successfully from the same systems through the forwarder to the indexer.
This is a broad question, however I will attempt to provide the main points I review when a forwarder does not work. Pardon any redundant questions. Did you configure the forwarder to send data to the main indexer through a specific tcp port? For Example under forwarding , click new forwarder, add "mysplunkforwarder.com:9999" Is there a corresponding port configured on your main indexer ? Is that TCP port available on your servers? Did you change the license on the forwarder to use the main indexer license? Did you specify an index to use with your data inputs or accept the default? Did you enable lightweight forwarding and restart Splunk after you verified the configuration? Can use use netstat -an to see if the connection was established? Any firewalls running?