Your outputs.conf on the forwarder seem to be sending to itself as "localhost"?
My forwarder looks like this, my indexer is .103
defaultGroup = default-autolb-group
server = 192.168.1.103:9997
I also suspect that you enabled the windows-TA when you installed the forwarder, those .conf files are inside
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\etc\apps\ That is why you are getting Windows data but not your datagateway log.
... View more