I have Splunk Light v6.2.3 instance with the Add-on for Nix V5.1.2 running. I have two universal forwarders v6.2.1 identically configured on two different Red Hat servers running the same operating system. I want to send all the logs from `/var/log/` to splunk. One server works and one server doesn't. I have verified connectivity from both servers. The one that doesn't work is slated to be the production instance of the one that works. etc/system/local/inputs.conf: [default] host = host1 index = syslog disabled = false [monitor:///var/log] etc/system/local/outputs.conf: [tcpout] defaultGroup = linux-group disabled = 0 [tcpout:linux-group] server = ##.##.##.32:514 [tcpout-server://##.##.##.32:514] Pretty basic config. I have a Windows forwarder which also works fine. I think I've read every Splunk doc there is and run every diagnostic I could. I've seen posts of others with a similar issue here and have verified every one of those answers marked as correct. There are some mention of associating the host with an index, but the steps only apply to the enterprise version. I can see data coming from both hosts in the receiver logs, it just doesn't show up in the interface. I've tried using different ports, reinstalling, and tried various versions just in case. Any help would be greatly appreciated! ... View more