This looks like close something I am experiencing. My understanding is the streamfwd binary needs to phone home to the Splunk App for Stream as described here: https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/DeploymentArchitecture#How_streamfwd_communicates_with_splunk_app_stream This is where you configure streamfwd to talk to the Stream App: https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/ConfigureStreamForwarder#Verify_location_of_splunk_app_stream_in_inputs.conf In your config this is set to: splunk_stream_app_location = http://localhost:8000/en-us/custom/splunk_app_stream/ To me it looks like your logs are showing that streamfwd is getting a connection refused when connecting via http to localhost on tcp port 8000. It's getting a connection refused when attempting that. Are you able to, on that same splunk server, access: http://localhost:8000/en-us/custom/splunk_app_stream/ping If you can't that might indicate your problem, i.e. a local firewall, DNS resolution of "localhost" etc might not be working for you? ... View more