Add support for splunk 5.0.2 and correctly support splunk forwarders (in
particular for splunk storm)