use splunkforwarder_output_dir 

use splunkforwarder_output_dir  to replace "/opt/splunkforwarder"