Can cooked data be altered again? Or retimestampped?

[daniel333]

All,

So I am receiving logs from another Splunk installation that is well cooked. How ever it's not correct, so I am looking to filter said data at a heavy forwarder before letting it into my network. How ever I am finding things like re-sourcetyping is not working. Is there a trick to enabling this?

[somesoni2]

When the cooked data is coming to an Splunk instance (like HF of yours), it doesn't get reparsed again, so any transforms that you want to apply (e.g. sourcetype renaming, filtering etc) would not work. Stating from this post, cooked events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf

  $Splunk_Home/etc/system/default/inputs.conf                             
 route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue

Now you can change this behaviour, but it can't be applied to a single sourcetype/source/host. It applies globally and it'll reparse, if already cooked, all data coming to that instance. You can find the value that you need to update to here:

https://answers.splunk.com/answers/97918/reparsing-cooked-data-coming-from-a-heavy-forwarder-possibl...

[niketn]

@daniel333 hope you are using the steps similar to the example https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides#Example:_Assign...

Also read about routing and filtering data on Splunk Docs

For us to assist you better, please provide some sample events and what you are trying to do also with the configurations props.conf and transforms.conf settings that you have currently setup. Please mock/anonymize any sensitive information.