Question about props.conf and light forwarders

[responsys_cm]

If I want to use SEDCMD to rewrite values in my data, should it be configured on the forwarder or the indexer?

Thx.

Craig

[jgedeon120]

If the forwarder is a heavy forwarder, full Splunk install, you can do it there. If not then you need to do it on the indexer.

[responsys_cm]

I'm running Splunk 4.3.4. I'm finding that I need to define my line breaking rules and timestamp extraction on the forwarder. Doing it on the indexer doesn't work.

[jgedeon120]

I stand corrected, it can be done on a lightweight forwarder.

http://splunk-base.splunk.com/answers/45411/rewrite-_raw-from-universal-forwarder-not-working