the universal forwarder does not parse data except in certain limited situations.can anyone tells what are these situations?
@Siddharthnegi
Reference - props.conf - https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf
I hope this helps!!!
The force_local_processing setting in props.conf will have the UF do some parsing. See props.conf.spec for details.