splunk forwarder

[Siddharthnegi]

the universal forwarder does not parse data except in certain limited situations.
can anyone tells what are these situations?

[VatsalJagani]

@Siddharthnegi

1. Structured Data
   1. As suggested in the doc shared by you, structured data is parsed by UF.
   2. INDEXED_EXTRACTIONS parameter in the props.conf
2. force_local_processing
   1. As suggested by @richgalloway - This will force linebreaker,
      aggerator, and the regexreplacement processors on UF.
   2. VatsalJagani_0-1715624743916.png

Reference - props.conf - https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf 

I hope this helps!!!

[richgalloway]

The force_local_processing setting in props.conf will have the UF do some parsing.  See props.conf.spec for details.