I had a similar issue however the solution was different because I had the correct syntax (I had the forward slashes).  I took the Windows TA and decided that for the WinNetMon stanza I only wanted it to go to specific windows servers as opposed to all of them in my environment. And instead of deleting the stanzas from the Splunk_TA_Windows/local/inputs.conf , I set disabled = 1. So when I created another app specific for the WinNetMon stanza and set that disabled = 0. The disabled = 1 took precedence over my custom app, hence Splunk could not find a WinNetMon stanza.  Deleting the WinNetMon stanzas from Splunk_TA_Windows/local/inputs.conf fixed my issue. ... View more