How to collect Slack logs

[euroa]

Hi,
I created an app with an inputs.conf file to collect syslog data (udp 514) from a particular host and send it to a sourcetype and index. I see the data coming in when I run a Wireshark but I dont see the data when I run a search query on the index I specified. Any clues?

[euroa]

I am collecting syslogs on a heavy forwarder and then forwarding that off to Splunk Cloud indexers.

Inputs.conf
[udp://ip address here:514]
connection_host = dns
sourcetype = slack
index = slack
disabled = false

outputs.conf (is contained on a different app that outputs all )

[tcpout]
defaultGroup = splunkcloud
forwardedindex.2.whitelist = (_audit|_introspection|_internal)

[tcpout:splunkcloud]
server = splunkcloud addresses here :9997
compressed = false

[esix_splunk]

Are you collecting the syslog on the Splunk indexer, or forwarding it from the box with a syslog input to another Splunk box? Please include you inputs and outputs conf files.