Getting Data In

Cooked data from heavy forwarder and feild extraction on the indexer

New Member

We are sending cooked ( parsed ) data from the heavy forwarders to the indexer .
We perform some transforms on the heavy forwarders .

We have a few feild extractions defined on the indexers.
Will this still be applied to data sent by the heavy forwarders ?

0 Karma


Hi deepthir,

it depends ©

If it is search time field extraction it will be applied, if they are set on the search head.
A good source to read - SORRY @piebob @ppablo_splunk and all the Splunk Docs Team (But this is still the best page to show this ) - is and you will learn the different configuration option you have.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...