topic Re: splunk forwarder in Dashboards & Visualizations

splunk forwarder

Siddharthnegi — Mon, 13 May 2024 15:54:49 GMT

the universal forwarder does not parse data except in certain limited situations.
can anyone tells what are these situations?

richgalloway — Mon, 13 May 2024 16:25:21 GMT

The force_local_processing setting in props.conf will have the UF do some parsing. See props.conf.spec for details.

VatsalJagani — Mon, 13 May 2024 18:27:12 GMT

Structured Data
1. As suggested in the doc shared by you, structured data is parsed by UF.
2. INDEXED_EXTRACTIONS parameter in the props.conf
force_local_processing
1. As suggested by @richgalloway - This will force linebreaker,
  aggerator, and the regexreplacement processors on UF.

I hope this helps!!!