https://community.splunk.com/t5/Getting-Data-In/Redirecting-data-through-two-heavy-forwarders-is-it-possible-to/m-p/267116#M51151 <P>All, </P> <P>I have data flowing through a heavy forwarder. Security wants a SECOND heavy forwarder that they manage to SEDCMD out certain PII. Is it possible to reprocess already cooked data?</P> Thu, 20 Oct 2016 17:58:23 GMT daniel333 2016-10-20T17:58:23Z https://community.splunk.com/t5/Getting-Data-In/Redirecting-data-through-two-heavy-forwarders-is-it-possible-to/m-p/267116#M51151 <P>All, </P> <P>I have data flowing through a heavy forwarder. Security wants a SECOND heavy forwarder that they manage to SEDCMD out certain PII. Is it possible to reprocess already cooked data?</P> Thu, 20 Oct 2016 17:58:23 GMT https://community.splunk.com/t5/Getting-Data-In/Redirecting-data-through-two-heavy-forwarders-is-it-possible-to/m-p/267116#M51151 daniel333 2016-10-20T17:58:23Z https://community.splunk.com/t5/Getting-Data-In/Redirecting-data-through-two-heavy-forwarders-is-it-possible-to/m-p/267117#M51152 <P>No. Once the data is passed the parsing phase it cannot go back. Even worse, you could end up with a situation where the events from a search show the SEDCMD data, but the interesting fields and _raw show the original data.</P> Thu, 20 Oct 2016 18:07:39 GMT https://community.splunk.com/t5/Getting-Data-In/Redirecting-data-through-two-heavy-forwarders-is-it-possible-to/m-p/267117#M51152 lukejadamec 2016-10-20T18:07:39Z