Same is happening for me. *nix forwarders are encrypting the sslPassword properly, but Windows forwarders are putting the hashed password somewhere else and leaving the initial configuration sslPassword in clear-text.
I feel It is a bug in Splunk. We have raised numerous cases with Splunk but in vain as the only recommendation they say is to put the password into "etc/system/local" !! We tried putting encrypted password directly into the app, but it didn't work.
If you analyse carefully, the password would have been encrypted and stored in another app's stanza. If you run btool on the client you would see the "stanza" in another app. So the solution is
- take the line of sslPassword out of the app and paste into $SPLUNK_HOME/etc/system/local/.conf
- Find the app which contains the sslPassword stanza which is encrypted. Move the sslPassword stanza to that app
I know, both of them are not perfect solutions.. but we couldn't find any other options.