Alas, the outputs.conf was in 'SPLUNK_HOME/etc/system/local/' but it was identical to the outputs.conf of the other forwarders. The thing that was also the same were the inputs.conf and the server.conf files: They were identical to one of the earlier servers. So it looks like my rush to copy directories (although I might have copied an entire splunk-forwarder installation and not just the local directory) is what is causing all the trouble: They missing 6 were reporting, just under a hostname of another box. So, I updated the hostnames and things suddenly started appearing under those new hostnames, in addition to the 10 I was seeing before. Many thanks for pointing me to a new place to look, woodcock. ... View more