Finally after weeks of banging my head against a brick wall I got my Splunk modular input to work, and know what's missing from their docs