Hi ajindal,
I confirmed Splunk Light is working correctly when adding and configuring a universal forwarder. I just went through the entire process as documented in the link I gave you, using Splunk Light 7.0.3, and Splunk Universal Forwarder 7.0.3. Make sure that your forwarder is compatible with your Splunk Light version.
To help you, I did some troubleshooting when I had issues getting a connection, so I uninstalled the forwarder and was very careful re-installing, making sure to:
Set the receiving port in the user interface to 9997 (TCP). This can be found at Data > Data receiving in the left sidebar menu.
Added the forward-server command. For example: ./splunk add forward-server IPaddress:9997 -auth admin:changeme
Added the deploy-poll command. For example ./splunk set deploy-poll IPaddress:8089. Note you are giving the management port number for Splunk Light here.
Performed a restart, for example ./splunk restart
Note:
-- After installing Splunk Light, the installation files are found in the Splunk directory, with splunk in the bin directory. Management port is typically 8089.
-- After installing the Splunk Universal Forwarder, the installation files are found in the SplunkForwarder directory, with splunk in the bin directory. The management port has to be different than Splunk Light's management port of 8089 or there is a conflict, so I set the universal forwarder's management port to 8090.
After the universal forwarder is installed and you perform a restart, the forwarder takes a few minutes to load. You should be able to see the forwarder on the Forwarder management screen after the restart. You can now add data. Click the Search tab > Add Data > Forward. You should see the attached add_data_universalforwarder screen. Select a new or existing Server Class from the Available hosts (host name) and add a Server Class Name if new > Click Next near the top of the screen to go to the next step.
To see the dashboard on the Forwarder monitoring screen, you must go to System > Forwarder monitoring in the sidebar menu and on the Forwarder monitoring screen click the box for Enable Forwarder Montoring. It does take a few minutes to load. See my attached monitoring-screen-uf screenshot of the Forwarder monitoring screen.
I suggest you confirm that you have the ports, IP address and commands correctly installed, and with no port conflicts.
Hope this helps.
... View more