Hello, As far as i know it works that way. So, if you are an Enterprise Customer you should fill a P4 case with your feature request. ... View more

Your outputs.conf on the forwarder seem to be sending to itself as "localhost"? My forwarder looks like this, my indexer is .103 OUTPUTS: [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = 192.168.1.103:9997 [tcpout-server://192.168.1.103:9997] I also suspect that you enabled the windows-TA when you installed the forwarder, those .conf files are inside C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\etc\apps\ That is why you are getting Windows data but not your datagateway log. ... View more