Not showing logs on deployment server

[abhijitm]

Hi all,

I have installed the splunk enterprise on server and deploy it on 8000 port.

Also add the receiver indexer configuration on splunk enterprise link with port 9997 and universal forwarder is installed on another server to collect and get the logs on splunk enterprise. At the time of installation i have entered the deployment server IP address  as server IP address where splunk enterprise is installed and port no (8000) and receiver indexer configuration set to port 9997.

After installation i have restarted the splunkuniversalforwarder. But logs are not getting at splunk enterprise.

So kindly assist me in this matter.

[richgalloway]

Universal Forwarders require an inputs.conf file to tell them which log to send to the indexer.  That file can be defined locally or come from a deployment server.  You told your UF to get it from a deployment server, but did you set up a DS?  You didn't mention it. On the search head (the instance listening on port 8000), go to Forwarder Management to set up the deployment server.  See https://docs.splunk.com/Documentation/Splunk/8.1.0/Updating/Deploymentserverarchitecture and https://docs.splunk.com/Documentation/Splunk/8.1.0/Updating/Planadeployment