It appears this behavior is by design and is not really a bug.
All "disabled = 1" means is the inheriting input stanzas should be disabled, not that the modular input is disabled.
A notion of disabled modular inputs does not exist in Splunk. Though, a modular input can be part of a disabled app, in which case the modular input will not be initialized (behaves as if it didn't exist).
So this is by design to allow maximum flexibility. Even if all input stanzas are disabled, it may be appropriate for a process to start and "do something".
The only way to get around this design annoyance is to also add "interval=-1" to the disabled stanza. This means the processes will run ONCE only at startup
... View more