If you want to use a Universal Forwarder, that is a separate install package entirely that can be downloaded here: http://www.splunk.com/download/universalforwarder The universal forwarder app should never be enabled on a full Splunk 4.2 install. I will not bore you with the explanation of why do we ship with that app in the first place, suffice it to say it is not ideal. To remedy this issue on your full install: % rm $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/local/app.conf % splunk restart ... View more