Your assumption about running reload deploy-server on the indexer is correct. As the forwarder stands now, the deploymentclient.conf is in etc/apps/ and there's none in etc/system/local ... splunkd is reporting that it's not a deployment client. I do have a couple of other active .conf files in etc/system/local to control the rest of the functions and intend to move those to apps next. I moved the deploymentclient.conf into my first app since it wouldn't affect the functionality of the other testing I was doing. ... View more

After thinking through the comments and conversing with one of our other admins, I decided to change the intermediate forwarder to a UF install. (We will always route data based on the host field, so the HF would've been overkill. Plus, I had some concerns about the parsing/indexing load on HFs that were built to be only very lightweight.) After adding a stanza in props.conf to look for splunk-if by IP and pointing it to the splunk-if stanza in transforms.conf (all on the indexer), I now have that data set routing into the desired alternate index. I still have a few other things on the To Do list before building the production servers, but this has helped me tremendously. Thanks for your help in getting me through this stage. ... View more