The indexer must be listening in the 9997/TCP port, and the UF usually uses a random port to conect to the indexer.
You can check this in the indexer with this command (I'm assuming you are running your indexer over Linux):
ss -putan | grep 9997
You should get something like this:
root@myindexer~# ss -putan | grep 9997
tcp LISTEN 0 128 *:9997 *:* users:(("splunkd",28307,42))
tcp **ESTAB** 0 0 yourindexerip:9997 youruniversalforwarderip:**33809** users:(("splunkd",28307,185))
In my case the port "33809" is any port that UF takes to connect with the indexer. You also may have your connection right and you are not seeing the UF in the deployment server because the connection is in the 8089TCP, maybe you are receiving logs but you are not be able to control the UF remotely.
... View more