Tag: how does splunk universal forwarder work