Great explanation thanks skalliger. To remain consistent with the documentation in v6.6 the splunktcp stanza should contain the foreslash escape character:
e.g.,
[splunktcp://9997]
This might have been a recent change since your reply was originally posted though 🙂
... View more