Difference in forwarders between 4.0.X and 4.1.4.

My Splunk indexer is running 4.1.4. But most of my forwarders have been running 4.0.X. I have recently started to upgrade them to 4.1.4.

Doing this, I noticed something.

I run this query to get the license usage on my indexer:

index=_internal todaysBytesIndexed LicenseManager-Audit NOT source=*web_service.log | eval Daily_Indexing_Volume_in_MBs = todaysBytesIndexed/1024/1024 | timechart avg(Daily_Indexing_Volume_in_MBs) by host

It would show me how much my indexer was indexing. The forwarders didn't show up in the output, which makes sense.

But as the forwarders get upgraded to 4.1.4, they're now showing up in the chart. It shows up as 0.000 MBs indexed, which would be correct, but I guess I'm surprised that they're showing up at all.

This isn't a problem; I can clean up my graph. I'm just wondering why it's happening...

I also saw a comment on another post: "I agree with gkanapathy that we expect 4.1 to be a noticable improvement in forwarder behavior, and it's not an urgent change." Where can I read about these improvements in forwarder behavior?

Thanks!