https://community.splunk.com/t5/Getting-Data-In/Where-do-INDEXED-EXTRACTIONS-happen/m-p/256583#M49325 <P>I have a Universal Forwarder reading data in a Tab Separated format. I want to apply the <CODE>INDEXED_EXTRACTIONS = TSV</CODE> to it. </P> <P>Do I need to put that on the Indexer or the Forwarder?</P> <P>A further question is that if the file is being appended to and the top line contains the headers, do I have to wait for the file to be rotated before I'll get the field extractions?</P> Fri, 04 Dec 2015 09:17:03 GMT joxley 2015-12-04T09:17:03Z https://community.splunk.com/t5/Getting-Data-In/Where-do-INDEXED-EXTRACTIONS-happen/m-p/256583#M49325 <P>I have a Universal Forwarder reading data in a Tab Separated format. I want to apply the <CODE>INDEXED_EXTRACTIONS = TSV</CODE> to it. </P> <P>Do I need to put that on the Indexer or the Forwarder?</P> <P>A further question is that if the file is being appended to and the top line contains the headers, do I have to wait for the file to be rotated before I'll get the field extractions?</P> Fri, 04 Dec 2015 09:17:03 GMT https://community.splunk.com/t5/Getting-Data-In/Where-do-INDEXED-EXTRACTIONS-happen/m-p/256583#M49325 joxley 2015-12-04T09:17:03Z https://community.splunk.com/t5/Getting-Data-In/Where-do-INDEXED-EXTRACTIONS-happen/m-p/256584#M49326 <P>You have to put this on every Forwarder and then restart all splunk instances there; read about this caveat here:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0/Data/Extractfieldsfromfileheadersatindextime#Caveats">http://docs.splunk.com/Documentation/Splunk/6.0/Data/Extractfieldsfromfileheadersatindextime#Caveats</A></P> Sat, 05 Dec 2015 19:46:15 GMT https://community.splunk.com/t5/Getting-Data-In/Where-do-INDEXED-EXTRACTIONS-happen/m-p/256584#M49326 woodcock 2015-12-05T19:46:15Z