RPM is called splunkforwarder