If you want to learn about Splunk data forwarding: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Aboutforwardingandreceivingdata Per default a Splunk Forwarder is sending data to port 9997 on a Splunk Indexer. This connection is a legacy format called "Splunk-2-Splunk" to optimize data transfer. As Martin mentioned you have to setup the Indexer correctly to receive data. HTH ... View more

maybe do this: sudo ln -s /opt/splunk/bin/splunk /etc/init.d/. ... so when your system restarts the correct splunk binary gets the "start" signal. If you followed the documentation for installing and starting splunk the first time, you probably assumed (as I did) that calling sudo -u splunk /opt/splunk/bin/splunkd start —accept-license would work for subsequent starts, and then got the libjemalloc.so.1 error. As mentioned above, giving the start command to the splunk binary (not splunkd) solves this. So the real answer to your question (assuming you've installed in the default /opt/splunk/ path) is: sudo /opt/splunk/bin/splunk start ... View more