Do NOT edit things in etc/system/default. Those are default values, not meant for local changes. For local changes, use local rather than default. https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Configurationfiledirectories What you describe - tcp port rather than splunktcp port - is exactly what's causing the indexer to not treat the cooked stream as cooked, and instead to index it as-is. turn off all tcp inputs you use to recieve data from forwarders (settings -> data inputs -> tcp) turn on receiving for those ports (settings -> forwarding and receiving -> configure receiving) ... View more