Hi all, I am trialling Splunk and installing it for the first time. I have installed the main Splunk server without problems and found the documentation and videos both useful and very applicable. However I have been struggling for several hours trying to get the universal forwarded installed and working. And I cannot find any "useful" documentation. I may well have missed something obvious, in fact I hope that is the case. First time I installed the universal forwarder I configured it to use the deployment server and gave server address and checked the standard 8089 port was listening on the server and that the client can reach it (they are on the same subnet). But netstat showed no comms between the two. So I uninstalled the universal forwarder and reinstalled to point to the server at a listener port. I then realised that this port is not listening on the server - but I though the docs suggested that would be a default listening port at 9997? So now I am about to set up a port on 9997 on the server. But I am asking myself, why am I doing this? What is the advantage / disadvantage of using a listener or a deployment server port to speak to the client's universal forwarder? It's not clear and I'm getting a bit frustrated with Splunk to be honest. I am running the server on Ubuntu server 12.04 and the Universal forwarder is on a client running Windows server 2008 R2 core. We have a mixed server environment. I understand that I may need to install the windows app on the server to allow correct indexing? So if someone could explain to me why should I use deployment server versus receiving indexer? And if I definitely need to install the windows app before I receive the data? Or call me a fool for missing some step by step and/or video demo of someone setting up the universal forwarder? Any help would be much appreciated. Thanks, Jamie ... View more