That is understood, but the Splunk Universal Forwarder 'splunk' utility is buggy and sometimes will not accept even a fully-qualified filename path.  Today we deployed identical rules for identical files across 100 servers, and about 20 of them failed with this error for no apparent reason. ... View more