You need to put that [source::.../....log4j] stanza on the forwarder, where it will be set on the input. Please see: http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F ... View more

I think the issue is that you don't have a stanza corresponding to your defaultGroup. According to the docs, in that case you are disabling automatic forwarding. I would make your output.conf look more like: [tcpout] defaultGroup = splunk [tcpout:splunk] disabled = false server = log1:9997 compressed = true ... View more