Hi,   thanks for your Inputs. Yes, I did the restart after updating the input.conf file. And, I am getting below output after running the btool debug,                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 filesPerDelay = 10 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 followLinks = false C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 fullEvent = false C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 hashMaxSize = -1 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = default C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 pollPeriod = 600 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 recurse = true C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 sendEventMaxSize = -1 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 signedaudit = true C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         [http] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         allowSslCompression = true C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         allowSslRenegotiation = true C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         dedicatedIoThreads = 2 C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         disabled = 1 C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         enableSSL = 1 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = default C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         maxSockets = 0 C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         maxThreads = 0 C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         port = 8088 C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         sslVersions = *,-ssl2 C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inpu ts.conf         useDeploymentServer = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 [monitor://C:\Program Files\SplunkUniversalForwarder\etc\splunk. version] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _TCP_ROUTING = * C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = _internal C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 sourcetype = splunk_version C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\spl unk] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = _internal C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\spl unk\license_usage_summary.log] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = _telemetry C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\defa ult\inputs.conf [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\spl unk\metrics.log] C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\defa ult\inputs.conf _TCP_ROUTING = * C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\defa ult\inputs.conf index = _internal C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\defa ult\inputs.conf [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\spl unk\splunkd.log] C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\defa ult\inputs.conf _TCP_ROUTING = * C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\defa ult\inputs.conf index = _internal C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf                 [monitor://C:\inetpub\logs\LogFiles] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf                 crcSalt = <SOURCE> C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf                 disabled = false C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = default C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf                 sourcetype = ms:iis:default C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 [script] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = default C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 interval = 60.0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 start_by_shell = false C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 [script://C:\Program Files\SplunkUniversalForwarder\bin\scripts\ splunk-wmi.path] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 disabled = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = default C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 interval = 10000000 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 persistentQueueSize = 200MB C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 queue = winparsing C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 source = wmi C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 sourcetype = wmi C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\defa ult\inputs.conf [splunktcp] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 acceptFrom = * C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 connection_host = ip C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = default C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\defa ult\inputs.conf route = has_key:tautology:parsingQueue;absent_key:tautology:pars ingQueue C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 [tcp] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 acceptFrom = * C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 connection_host = dns C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = default C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 [udp] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 connection_host = ip C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                 index = default ... View more