Windows UniversalForwarder not registering Syslog input

[pkarpushin]

I am trying to make UniversalForwarder on Windows Server 2008 R2 Standard act as a syslog data receiver and forward this data to the Indexer.
It seems that Splunk on this Windows machine does not handle incoming syslog data.
Below is config:
C:\SplunkUniversalForwarder\bin>splunk.exe cmd btool inputs list udp
[udp]
_rcvbuf = 1572864
connection_host = ip
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 0
host = Splunk-gtw
index = default
[udp://514]
_rcvbuf = 1572864
connection_host = ip
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 0
host = Splunk-gtw
index = default

C:\SplunkUniversalForwarder\bin>netstat -apb UDP
Active Connections
Proto Local Address Foreign Address State
UDP 0.0.0.0:123 *:
W32Time
[svchost.exe]
UDP 0.0.0.0:514 :
[splunkd.exe]*

I see data in Wireshark capture, but metrics.log shows this:
6-15-2018 13:23:12.395 +0300 INFO Metrics - group=queue, name=udp_queue, max_size_kb=500, current_size_kb=0, current_size=0, largest_size=0, smallest_size=0
06-15-2018 13:23:12.395 +0300 INFO Metrics - group=udpin_connections, *:514, sourcePort=514, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00

Please advise what may be the source of the trouble

[lmaclean]

Is Splunk running as SYSTEM or as a user and if as a user does it have the required permissions to listen to ports on Windows?

Have you checked splunkd.log when it starts up for "TcpInput" type components and if there are any issues it is reporting?

[splkmika1]

tried running it as the default Windows LocalSystem account, so the permissions I think should be ok. I could also see the Universal Forwarder exe listening on udp 514 with a netstat -a -b.

I've given up on this and just gone with using an external syslog server with a Universal Forwarder installed.
Thanks for your response.

[splkmika1]

Hi, did you ever resolve this issue? I am observing the same issue in my network at the moment.

[pkarpushin]

No, unfortunately. I had to give up listening 514 udp on my Windows machine, and started monitoring log files on a remote machine instead.

[splkmika1]

no worries. Thanks. Yeah I moved over to monitoring files on a separate syslog server as well.