i had the same problem, couldnt connect to indexer
in windows for universal forwarder installation ( 5.0.4) please check the files in:
path "\SplunkUniversalForwarder\ etc\ system\ local "
replace the config files under with those from:
path \SplunkUniversalForwarder\ etc\ apps\ Windows\ local
restart splunkforwarder:
splunk restart
it should get connected
in splunk host i can see the forwarder has been connected and it has send logs. i had activated some advanced audit features.
... View more