I installed and configured Universal Forwarder in AIX but it does not send data to splunk server. I configured index in splunk server and add it to Universal Forwarder (inputs.conf) but the problem continue.
I resolved it, was necessary to activate deploy in AIX. Now I have another problem. I configured only 3 hosts like forwarders but in App > Search&Reporting > Data Summary I find more hosts, some of them are not configured like forwarders. Why is possible that one host send logs to splunk when forwarders is not configured in it?
Did you configure outputs.conf and inputs.conf? You need to make sure that:
See these references:
http://www.splunk.com/base/Documentation/latest/Admin/Inputsconf?r=splunky
http://www.splunk.com/base/Documentation/latest/Admin/Outputsconf?r=splunky