Hi,
After posting a question I learned that the underlying behaviour lies with an internal application and not is not a Splunk problem. The error messages noted in my question also came from this internal application.
This means that the question I posted will only cause confusion for the community.
How can I ask for it to be removed?
Regards,
Marc
The question in question is https://community.splunk.com/t5/Splunk-Search/Misconfigured-search-not-forwarding-events/m-p/519691#...
you can update your solution to the question posted. so that it might be useful to community members.