I got this error as well:
10-09-2014 15:46:27.158 +0100 ERROR ExecProcessor - message from "E:\tools\SplunkForwarder\bin\splunk-admon.exe" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.
Had checked the \bin directory, the splunk-admon.exe is not missing.
Not sure what to do next though.
... View more