Is tags.conf  a config that can be applied at the config of universal-forwarder or is it an indexer config only feature?  Where would it have to be place in the forwarder directory to make it effective?  I have tried:  /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/tags.conf with the following config: [host=myhost.mydomain.net] nonproduction=enabled testsystem=enabled ... View more