I noticed the same thing. The search in the deployment monitor app is labeling anything in the metrics log that is "raw" or "rawSSL" as "Legacy Forwarder".
Here is a small part of the search string that causes that:
connectionType=="raw" or connectionType=="rawSSL","Legacy Forwarder")
I guess the proper question is why Splunk sees that data as "raw". I'm think it is because it is a TCP input and not "cooked" by a forwarder. My guess is that this is a bug in that specific search being too broad with its definition of "Legacy Forwarder".
All speculation and guesses based on about 20min of research...
You can find that search by going to the Forwarders screen in the Deployment Monitor App and then opening the jobs screen (upper right link). It should be the top search.
E.
I have the same issue. Noticed this after forwarding metrics.log from our heavy forwarder to an indexer. There are about twenty raw TCP inputs into this heavy forwarder and for some reason it sees only one connectionType=raw in there as a Legacy Forwarder... I'm lost.