https://community.splunk.com/t5/Getting-Data-In/What-configuration-settings-are-used-by-universal-forwarders/m-p/85366#M17765 <P>Does anyone have a specific listing of what configuration options are honored by the universal forwarder and which ones are not?</P> <P>I know that parsing and merging happens at the indexer (or intermediate heavy forwarder), but I'm not sure about all the other settings. I read somewhere that the <CODE>CHARSET</CODE> has to be set on the universal forwarder, but is that the only one?</P> <P>I thought a found this in the docs or in a post at one point, but I can't seem to find that information again.</P> Wed, 27 Jun 2012 18:32:47 GMT Lowell 2012-06-27T18:32:47Z https://community.splunk.com/t5/Getting-Data-In/What-configuration-settings-are-used-by-universal-forwarders/m-p/85366#M17765 <P>Does anyone have a specific listing of what configuration options are honored by the universal forwarder and which ones are not?</P> <P>I know that parsing and merging happens at the indexer (or intermediate heavy forwarder), but I'm not sure about all the other settings. I read somewhere that the <CODE>CHARSET</CODE> has to be set on the universal forwarder, but is that the only one?</P> <P>I thought a found this in the docs or in a post at one point, but I can't seem to find that information again.</P> Wed, 27 Jun 2012 18:32:47 GMT https://community.splunk.com/t5/Getting-Data-In/What-configuration-settings-are-used-by-universal-forwarders/m-p/85366#M17765 Lowell 2012-06-27T18:32:47Z https://community.splunk.com/t5/Getting-Data-In/What-configuration-settings-are-used-by-universal-forwarders/m-p/85367#M17766 <P>Were you thinking of this wiki article?</P> <P><A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F">Where do I configure my Splunk settings?</A></P> Thu, 28 Jun 2012 00:49:15 GMT https://community.splunk.com/t5/Getting-Data-In/What-configuration-settings-are-used-by-universal-forwarders/m-p/85367#M17766 lguinn2 2012-06-28T00:49:15Z