This is a broad question, however I will attempt to provide the main points I review when a forwarder does not work. Pardon any redundant questions. Did you configure the forwarder to send data to the main indexer through a specific tcp port? For Example under forwarding , click new forwarder, add "mysplunkforwarder.com:9999" Is there a corresponding port configured on your main indexer ? Is that TCP port available on your servers? Did you change the license on the forwarder to use the main indexer license? Did you specify an index to use with your data inputs or accept the default? Did you enable lightweight forwarding and restart Splunk after you verified the configuration? Can use use netstat -an to see if the connection was established? Any firewalls running?
