when i had tried running
index="_internal" host="heavyforwarder3" "sourcefire" , we got this excepotion
02-02-2018 05:35:36.074 -0500 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/sourcefire/bin/client_check.py
From the inputs.conf doc, it says that when using a script, the script must be located in a specific directory, which doesn't appear to be the case in your setup:
* The <cmd> must reside in one of the following directories:
The monitor statement should use the full absolute path, not the $SPLUNK_HOME variable within it, again from the docs:
* You must specify the input type and then the path, so put three slashes in
your path if you are starting at the root on *nix systems (to include the
slash that indicates an absolute path).
Try changings these to follow the spec and then see what you get after.