topic Re: Can we perform ingest rules on cooked data? in Getting Data In

Can we perform ingest rules on cooked data?

danielbb — Mon, 13 Oct 2025 19:21:21 GMT

We have cooked data coming from HFs, is there a way to perform ingestion rules on this cooked data?

Re: Can we perform ingest rules on cooked data?

PickleRick — Mon, 13 Oct 2025 19:36:39 GMT

I suppose you mean "cooked and parsed" (after being processed by HF or coming from another "heavy" component). Yes, you can use RULESET to manipulate already parsed data. (ingest actions are "just" a frontend to some subset of RULESET functionality).

Re: Can we perform ingest rules on cooked data?

PrewinThomas — Tue, 14 Oct 2025 04:02:52 GMT

@danielbb
You can refer these 2 links,

#https://splunk.my.site.com/customer/s/article/Where-does-parsing-happen-if-the-data-goes-through-multiple-Splunk-instances

#https://help.splunk.com/en/splunk-cloud-platform/get-started/splunk-validated-architectures/getting-data-in-forwarding-and-preprocessing/intermediate-data-routing-using-universal-and-heavy-forwarders