Yep, you can throw it into the data preview to get a first idea of what splunk would make of it and to start working on the settings you need if splunk cannot understand specifics such as timestamps or event braking out of the box.
There are many ways to mess up the configuration. Does the data get the correct sourcetype in the inputs.conf on the forwarder? Is the sourcetype fully defined in props.conf on the indexer?
To ease debugging, do post both configuration extracts.
Many thanks, how obvious are these? - when I'm doing data preview I can't seem to spot any issues however when I enable the forwarder I see Failed to parse timestamp errors
