The contents of this comment should replace: http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Useforwardingagentstogetdata
I spent hours trying to get the universal forwarder working on a linux box using that link, it only took a few minutes using MillerTime's instructions.
... View more