Basic universal forwarder setup with splunk enterprise

[fgoodwin]

I am rolling out a trial instance of splunk enterprise, I have it running on a 2012r2 vm, and have installed the Universal Forwarder on two workstations pointing at it. My trouble is that I do not receive any data from the workstations. I have gone over the install/troubleshooting documentation several times but I feel like I'm missing something obvious, as the documentation seems to just assume that once you install the forwarder it should just work.

Do I need to make config changes on the server to support data input from the forwarder, or should they talk to eachother out of the box if the forwarder is pointed at the right IP?

Are there any youtube or other top to bottom no steps skipped idiot level tutorials I could follow through to find what I'm missing?

Thanks.

[FrankVl · Accepted solution]

1. Do you have a splunktcp input configured on your Enterprise instance?
2. Is the outputs.conf on your UF pointing to that Enterprise instance's IP and the port of that splunktcp input?
3. Do you have any inputs configured on your UF? If so: which?
4. Any errors / warnings in splunkd.log on any of your instances?

Also check out: http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata

[fgoodwin]

I removed and re-added the 9997 receiver and reinstalled the universal forwarder on the client and it looks like its working this time. Thanks for the help.