I faced the same issue for some other app on linux, when someone started forwarder with root user and then started it again with splunk user, the workaround is to create a new serverclass (with new name) and add the apps and clients to it.
... View more