Well it seems that it's an issue in Splunk 8.0.x.  SPL-170987. I don't see it listed in Splunk 8.1 or higher so maybe it's fixed there (it's not listed in the fixed section though). ... View more

Did you ever figure this out?  I'm noticing this on one of my test instances too. ... View more