Thank you for this information!! I greatly appreciate it, Ken ... View more

The correct workaround should have been     [tcpout] negotiateProtocolLevel = 5      negotiateProtocolLevel = 0 is no longer valid (see enableOldS2SProtocol in 9.1.x outputs.conf) with 9.1.x and is likely to cause issues. ... View more

I encounter this as well when running splunkforwarder on kubernetes cluster as daemonset. This was solved by mounting the volume to /opt/splunkforwarder-etc/ instead of /opt/splunkforwarder. It seems that all the local/custom configuration should be implemented on /opt/splunkforwarder-etc/ ... View more

KV_MODE = json your question is corrected and spath works fine, basically this setting is work. If you modify conf, you must restart splunk. ... View more