There are 2 options. 1 is the regular 'update' which you have selected, and then an additional 'rebuild forwarder assets' button that will do a complete rebuild. They both use saved searches, one is the update which is activated when you select 'Enable', and the other you can setup for a regular rebuild to clear out the older forwarders if you wish. Especially useful when you have AWS or similar that regularly redeploys environments. Some more detail available at: Use the Forwarder dashboards - Splunk Documentation ... View more

I found this issue myself, and some of the automatic lookups had things like: windows_action_lookup Type OUTPUTNEW action, action AS status Resaving them then resolved them back to  windows_action_lookup Type OUTPUTNEW action AS status Which has then resolved the issue. It appears that the Splunk_TA_Windows had these lookup issues, seems to work correctly as most entries had action fields in them anyway. ... View more