Did you deploy this to your Indexers and after that did you restart all Splunk instances on the Indexers? ... View more

Yes. There should be configuration details in outputs.conf describing the server(s) to which events should be sent. You can find the spec for outputs.conf here: http://docs.splunk.com/Documentation/Splunk/6.1.1/Admin/Outputsconf At the bottom of the outputs.conf spec file you will find examples showing the minimum info needed. The splunk universal for windows has default inputs which are routed to the _internal index. Once you get outputs functioning you can go to your search head and search index=_internal host="yourwindowshostname" to verify that events are searchable ... View more