We fixed this issue by changing the HEC endpoint that the data was being sent to from services/collector/raw to  services/collector/event. More information here: https://docs.splunk.com/Documentation/Splunk/latest/Data/HECRESTendpoints ... View more

@Dave2d   Did you ever find a resolution for this issue?  Thanks! ... View more

Updated link: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Whathappenswhenamanagernodegoesdown ... View more

I ran into this same issue on Splunk 8.0.10 and Cisco eStreamer eNcore 4.8.3 Add-on.  The solution for me was to move the setup.xml from the bin folder to the default folder. mv /opt/splunk/etc/apps/TA-eStreamer/bin/setup.xml /opt/splunk/etc/apps/TA-eStreamer/default/   ... View more