Thanks @gcusello  ... View more

OK. Now we're getting somewhere 😉 Poet 9997 is for data forwarding. Forwarders register in Deployment Server on 8089. Also you need to configure the client to use a DS - with Windows UF, if you installed it interactively, you had a dialog during installation letting you specify the DS address. If you pointed it to your Splunk Server, enabled the DS functionality on your Splunk server and opened the 8089 port, the forwarder should register itself with the DS. So that's the reason why you're not seeing your UF as deployment client. If you provided target indexer address during UF installation, you should be (if everything works OK) seeing forwarders internal log in the _internal index. ... View more