Which network topology is the best for school network?

It seems like the issue might be related to either the Splunk Universal Forwarder configuration or log file permissions. First, ensure that your inputs.conf and outputs.conf files are correctly set up, with the right log paths and destination indexer details. Check the internal logs, such as splunkd.log, by navigating to /opt/splunkforwarder/var/log/splunk/ instead of /var/log. If no logs are present, verify that the Universal Forwarder has the right permissions to access the log files and is running properly. You can enable debug logging in the log.cfg file for more detailed output and restart the forwarder to apply any changes.