Found another user with this problem, answers.splunk.com/answers/85935/forward-to-splunk-storm-using-universal-forwarder-through-proxy
They quote a insufficient response from splunk
If the problem is directly linked to
your company proxy (or firewall),
there is nothing that we can do.
Splunk protocol requires a connection
on the port 9997, with acknowledgement
back. Please contact your entreprise
network team to see if they can open
the port and route the data to it.
Also found this article - docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Setupforwardingandreceiving
Note: You cannot forward data across a proxy, because the communication between forwarder and receiver does not use the HTTP protocol.
... View more