hokie1999,
One thing to note here. You edited your default inputs.conf. This is generally considered bad practice. If you were to update your universal forwarder to a newer version, the update process would revert your change back to, as the name implies, the default.
Right at the top of the default/inputs.conf (as well as other default/*.conf files) there is a warning stating not to edit the file.
You need to make this change in the local inputs.conf. In /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/, there should be a local directory. In it, there may or may not be a inputs.conf file. If there is, great, make your changes there. If there isn't, just copy the inputs.conf from the default directory into the local directory. Then make your changes to the inputs.conf in the local directory.
... View more