I have one universal forwarder which is reporting to DS and receiving internal logs, but i am not getting any data into index. Logs are present in the server.
From what you're saying I understand that your UF manages to register itself with the DS so you can see it in the DS console. But do you have any outputs defined on this UF? Either locally or by means of app deployed from DS...
Check if UF is throwing any permission issues while reading the log files (index=_internal host=UF sourcetype=splunkd permission denied. OR similar search). If you've backend access to the forwarder, you can check the permissions on the file to ensure that splunk user (or user with which Splunk forwarder is running) can access the files.
Run btool on UF to ensure correct inputs.conf is present ($SPLUNK_HOME/bin/splunk btool inputs list --debug | grep -v system/default)
Run Splunk CLI command to check currently monitored files. ($SPLUNK_HOME/bin/splunk list monitor)
