Either Splunk does not like your strange name (with all those numbers and dots/periods) or your indexers have SSL turned on and are listening on port 9998 in stead of port 9997. There are tools to check which ports have listeners (I do not know your OS) or you can just experiment (try changing your default group to use alpha-only). Here is another answer that shows a working pair of configuration files: http://answers.splunk.com/answers/110392/ssl-connection-between-indexer-and-forwarder.html ... View more