Thanks for your help.
I tried to do the step 1 and apparently, a firewall between the both server blocked my port.
After open the port on firewall, I've seen some pushed event on my splunkd.log
Am I supposed to see always a registred channel ? I got a "unregistred channel for", this is problematic for something ?
01-16-2015 10:23:27.815 -0500 DEBUG TcpOutputProc - channel not registered yet
01-16-2015 10:23:27.816 -0500 DEBUG TcpOutputProc - Registering Channel for : source::/opt/splunkfw/var/log/splunk/splunkd.log|host::Indexer|splunkd|45Indexer:8090, oneTimeClient=0, _events.size()=0, _refCount=2, _waitingAckQ.size()=0, _supportsACK=0, _lastHBRecvTime=Fri Jan 16 10:23:27 2015
01-16-2015 10:23:27.816 -0500 DEBUG TcpOutputProc - Pushed eventId=2105 on chanID=5 to back of tcp client (tcp output) queue
01-16-2015 10:23:27.816 -0500 DEBUG TcpOutputProc - channel registered
01-16-2015 10:23:27.816 -0500 DEBUG TcpOutputProc - Unregistering Channel for : source::/opt/splunkfw/var/log/splunk/splunkd.log|host::Indexer|splunkd|45Indexer:8090, oneTimeClient=0, _events.size()=0, _refCount=3, _waitingAckQ.size()=0, _supportsACK=0, _lastHBRecvTime=Fri Jan 16 10:23:27 2015
Another question about the Indexer that receive the logs from my forwarder, how and where I can see in the command line on the indexer server that my logs has been received completely ?
... View more