https://community.splunk.com/t5/Getting-Data-In/Communication-between-forwarder-and-indexer/m-p/89613#M18598 <P>If you look at inputs.conf you'll have to configure it. The default setting is false for compression. </P> <P>compressed = [true|false]<BR /> * Specifies whether receiving compressed data.<BR /> * If set to true, the forwarder port(s) should also have compression turned on; otherwise, the receiver will <BR /> reject the connection.<BR /> * Defaults to false.</P> Tue, 03 Jul 2012 17:26:48 GMT sdaniels 2012-07-03T17:26:48Z https://community.splunk.com/t5/Getting-Data-In/Communication-between-forwarder-and-indexer/m-p/89612#M18597 <P>Hey Splunkers! </P> <P>I always thought or heard that data that gets input to forwarder gets "cooked" meaning compressed before it gets sent over to Indexer, but when we actually done a TCP DUMP to see the data, we ware able to see it as ASCII.</P> <P>What is true? Based on the TCPDUMP capture we were able to see the ASCII data, so that proves that the data isn't being compressed / "Cooked".</P> <P>Anybody know the answer to this?</P> Tue, 03 Jul 2012 17:21:25 GMT https://community.splunk.com/t5/Getting-Data-In/Communication-between-forwarder-and-indexer/m-p/89612#M18597 clyde772 2012-07-03T17:21:25Z https://community.splunk.com/t5/Getting-Data-In/Communication-between-forwarder-and-indexer/m-p/89613#M18598 <P>If you look at inputs.conf you'll have to configure it. The default setting is false for compression. </P> <P>compressed = [true|false]<BR /> * Specifies whether receiving compressed data.<BR /> * If set to true, the forwarder port(s) should also have compression turned on; otherwise, the receiver will <BR /> reject the connection.<BR /> * Defaults to false.</P> Tue, 03 Jul 2012 17:26:48 GMT https://community.splunk.com/t5/Getting-Data-In/Communication-between-forwarder-and-indexer/m-p/89613#M18598 sdaniels 2012-07-03T17:26:48Z