Hi @ITSplunk117, if you are able to see the Splunk restart on that forwarder you'll see that a configuration error was found. Anyway, the input stanza isn't running and you haven't those data. You have two way to solve yur issue: if you're using a Deployment Server to manage Forwarders, you can correct the error in the app to deploy and deploy it again. If you aren't using a DS (it isn't a good idea and possible only for little labs uses), you have to manually correct the error accessing the inputs.conf file and after restarting Splunk on the Forwarder. Ciao. Giuseppe Ciao. Giuseppe
... View more