updating service to work with splunk forwarder