By setting it to "free" you have disabled your ability to use your Search Head as a Deployment Server so that the forwarder can be configured from the Search Head (Deployment Server) using the Settings -> Add data -> Forward data from splunk forwarder . You can still forward from your forwarder but you have to do it from the CLI on the forwarder itself. If you have access to the CLI of the forwarder you can use oneshot or inputs.conf : https://docs.splunk.com/Documentation/Splunk/6.5.2/Data/MonitorfilesanddirectoriesusingtheCLI https://www.google.com/search? ... View more

You should post a new question. ... View more

Hi cboard, did you test connection between servers? (from server 2 telnet server1_IP 9997 ) did you disabled iptables on both the servers for ports 9997 and 8089? Bye. Giuseppe ... View more