I have one machine with Splunk Enterprise and on another machines I've installed a universal forwarder. Even-though everything seems ok from the installation point of view, somehow  Spunk Enterprise does not detect the forwarder: - In the Splunk Web interface I've  enabled receiving on port 9997 ( Splunk Web: Settings -> Forwarding and receiving ) - After installing the forwarder (linux) , I've started it from /bin : ./splunk start (accepted license) ./splunk add forward-server <splunk_web_server>:9997 # add a source ./splunk add monitor /var/log/auth.log -sourcetype linux_secure ./splunk restart Am I missing something ? Thx ... View more