Communication between forwarder and indexer

[clyde772]

Hey Splunkers!

I always thought or heard that data that gets input to forwarder gets "cooked" meaning compressed before it gets sent over to Indexer, but when we actually done a TCP DUMP to see the data, we ware able to see it as ASCII.

What is true? Based on the TCPDUMP capture we were able to see the ASCII data, so that proves that the data isn't being compressed / "Cooked".

Anybody know the answer to this?

[sdaniels]

If you look at inputs.conf you'll have to configure it. The default setting is false for compression.

compressed = [true|false]
* Specifies whether receiving compressed data.
* If set to true, the forwarder port(s) should also have compression turned on; otherwise, the receiver will
reject the connection.
* Defaults to false.