I can't see the event logs on splunk server from linux forwarder even though I setup the universal forwarder

[Kendrick]

I can't see the events log when I searching on splunk enterprise server. But I already check the splunk server status is running and I created the index = linux_universal_forwarder and host = linux_uf_1 into inputs.confg on forwarder linux machine. And I also created the receiving new port 8889 and new index = linux_universal_forwarder on splunk server. Why I can't see the logs ? I can able to ping between indexer and forwarder. Pls help how to fix this issue? how to troubleshoot step by step? I'm beginner to learn the Splunk. Thank you.

[richgalloway]

You have an established connection between the forwarder and the indexer on port 9997 so there's no need for port 8889.

The search query (index=_internal ...) should be entered in the Splunk UI (use the "Search & Reporting" app).

The add monitor command is entered in the CLI, but the "/path/to/app/logs" argument is a placeholder (like "foo") that must be replaced by the actual file to file you wish to monitor.