Perhaps try this as a scripted input.
Create an executable bash script with the command exec journalctl --since=now -f -u isc-dhcp-server
Add the script as an input on the forwarder:
$SPLUNK_HOME/bin/splunk add exec \
-source $SPLUNK_HOME/bin/scripts/myScriptName.sh \
-interval = 0
... View more