Testing on my local Splunk looks good - I have results in index.
In _internal there is something like this:
03-09-2016 12:27:50.235 +0100 INFO ArchiveProcessor - Finished processing file '/apps/sms/2016_03_07.obj', removing from stats
03-09-2016 12:27:49.579 +0100 INFO ArchiveProcessor - reading path=/apps/sms/2016_03_07.obj (seek=0 len=166756)
03-09-2016 12:27:49.579 +0100 INFO ArchiveProcessor - handling file=/apps/sms/2016_03_07.obj
Now I try to do the same in distributed environment:
I put this props.conf on universal forwarder (for NO_BINARY_CHECK setting), and on master cluster (then click "distribute configuration bundle to indexers).
I can read the same data in _internal, but actually no data is indexed.
What should I do, and why this doesn't work?