hello there,
please make sure you enable inputs on your Indexer as well as outputs on the correct port on the forwarder
also worthwhile to check there arent any blocks (firewall rules) on the way
more info here:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Troubleshooting/Cantfinddata
hope it helps
... View more