splunkd.log shows that everything seems to be working fine. In the metrics log, it seems that there is nothing collected and sent, but not really sure about it. I did find that there is this line that makes it seem that it is trying to communicate with the indexer and DS. INFO StatusMgr - destHost=<ip>, destIp=<ip>, destPort=9997, eventType=connect_try, publisher=Tcpout, sourcePort=8089, statusee=TCPOutputProcessor INFO StatusMgr - destHost=<ip>, destIp=<ip>, destPort=9997, eventType=connect_fail, publisher=Tcpout, sourcePort=8089, statusee=TCPOutputProcessor
... View more