topic Re: Does Heavy forwarder forwarded events will undergo parsing on indexers in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Does-Heavy-forwarder-forwarded-events-will-undergo-parsing-on/m-p/298804#M56503 <P>Why would you want to do that, what is your use case?</P> Wed, 23 Aug 2017 16:05:58 GMT s2_splunk 2017-08-23T16:05:58Z Does Heavy forwarder forwarded events will undergo parsing on indexers https://community.splunk.com/t5/Getting-Data-In/Does-Heavy-forwarder-forwarded-events-will-undergo-parsing-on/m-p/298802#M56501 <P>my Heavy forwarder is forwarding events to Splunk indexers. Does link breaking , aggregation etc takes place on indexers again? <BR /> If not is there any way to make events to undergo parsing on indexers even though they already got parsed on Heavy Forwarders?</P> Wed, 23 Aug 2017 14:36:45 GMT https://community.splunk.com/t5/Getting-Data-In/Does-Heavy-forwarder-forwarded-events-will-undergo-parsing-on/m-p/298802#M56501 ankithreddy777 2017-08-23T14:36:45Z Re: Does Heavy forwarder forwarded events will undergo parsing on indexers https://community.splunk.com/t5/Getting-Data-In/Does-Heavy-forwarder-forwarded-events-will-undergo-parsing-on/m-p/298803#M56502 <P>Splunk doesn't reparse the data at indexer once it's already parsed (cooked) at Heavy forwarder level. You can follow configuration from following post to enable reparsing at indexer.<BR /> <A href="https://answers.splunk.com/answers/224312/hf1-hf2-indexer-how-to-route-a-set-of-data-that-ha.html">https://answers.splunk.com/answers/224312/hf1-hf2-indexer-how-to-route-a-set-of-data-that-ha.html</A></P> <P>Please note that you can't enable this setting for selected data/sourcetype, so if enabled, it will reparse all data that comes in.</P> Wed, 23 Aug 2017 15:00:13 GMT https://community.splunk.com/t5/Getting-Data-In/Does-Heavy-forwarder-forwarded-events-will-undergo-parsing-on/m-p/298803#M56502 somesoni2 2017-08-23T15:00:13Z Re: Does Heavy forwarder forwarded events will undergo parsing on indexers https://community.splunk.com/t5/Getting-Data-In/Does-Heavy-forwarder-forwarded-events-will-undergo-parsing-on/m-p/298804#M56503 <P>Why would you want to do that, what is your use case?</P> Wed, 23 Aug 2017 16:05:58 GMT https://community.splunk.com/t5/Getting-Data-In/Does-Heavy-forwarder-forwarded-events-will-undergo-parsing-on/m-p/298804#M56503 s2_splunk 2017-08-23T16:05:58Z