topic Re: Where index time extraction will happen? in Getting Data In

Where index time extraction will happen?

VatsalJagani — Sun, 05 Jul 2020 16:32:50 GMT

I've below Splunk architecture in my environment.

Universal Forwarders (Linux and Windows) -> Heavy Forwarder -> Indexers (cluster)

I want to know where the index-time field extraction will happen?

On Heavy forwarder
On Indexers
On both (in this case, will indexer overrides the fields extracted by HF?)

Are there any specific properties in props/transforms which execute on a specific component in a distributed environment?

Re: Where index time extraction will happen?

isoutamo — Sun, 05 Jul 2020 16:40:13 GMT

if you have HFS on path then extractions will happen on the first non UF Splunk Enterprise instance (HF - IDX, if there are several HFs on lane then the first one is the correct place).

r. Ismo

Re: Where index time extraction will happen?

gjanders — Mon, 06 Jul 2020 01:07:12 GMT

@isoutamo's answer is valid but the https://www.aplura.com/assets/pdf/where_to_put_props.pdf document will explain this in a bit more detail

Re: Where index time extraction will happen?

VatsalJagani — Mon, 06 Jul 2020 04:21:15 GMT

@gjanders - Thanks, this is really helpful diagram.