Thanks @darrenk_splunk . Based on the info that you provided, I agree...it is not a bug. The Linux "cat" and grep commands help explain the unexpected output also. [root@localhost bin]$ cat /opt/splunk/etc/system/default/inputs.conf | grep "monitor://" [monitor://$SPLUNK_HOME/var/log/splunk] [monitor://$SPLUNK_HOME/var/log/watchdog/watchdog.log*] [monitor://$SPLUNK_HOME/var/log/splunk/license_usage_summary.log] [monitor://$SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log*] [monitor://$SPLUNK_HOME/etc/splunk.version] [root@localhost bin]$ ... View more