Can we perform ingest rules on cooked data?

[danielbb]

We have cooked data coming from HFs, is there a way to perform ingestion rules on this cooked data?

[PrewinThomas]

@danielbb 
You can refer these 2 links,

#https://splunk.my.site.com/customer/s/article/Where-does-parsing-happen-if-the-data-goes-through-mul...

#https://help.splunk.com/en/splunk-cloud-platform/get-started/splunk-validated-architectures/getting-...

[PickleRick]

I suppose you mean "cooked and parsed" (after being processed by HF or coming from another "heavy" component). Yes, you can use RULESET to manipulate already parsed data. (ingest actions are "just" a frontend to some subset of RULESET functionality).