Splunk lens does not work with modern Universal Forwarder

[jantman]

The Splunk lens does not function with modern versions of the Splunk Universal Forwarder:

1. The Universal Forwarder package on Linux installs under /opt/splunkforwarder, so the lens should include at least /opt/splunkforwarder/etc/system/local/*.conf and /opt/splunkforwarder/etc/apps/*/default/*.conf.
2. Per the documentation on inputs.conf, this INI-like file supports numerous "_" prefixed keys, such as _meta, _TCP_ROUTING, _SYSLOG_ROUTING, etc. These keys cause the current Splunk lens to error, as IniFile.entry_re is /[A-Za-z][A-Za-z0-9._-]*/ (i.e. it does not accept underscore-prefixed keys).