Cooked data from heavy forwarder and feild extraction on the indexer

[deepthir]

We are sending cooked ( parsed ) data from the heavy forwarders to the indexer .
We perform some transforms on the heavy forwarders .

We have a few feild extractions defined on the indexers.
Will this still be applied to data sent by the heavy forwarders ?

[MuS]

Hi deepthir,

it depends ©

If it is search time field extraction it will be applied, if they are set on the search head.
A good source to read - SORRY @piebob @ppablo_splunk and all the Splunk Docs Team (But this is still the best page to show this ) - is http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F and you will learn the different configuration option you have.

Hope this helps ...

cheers, MuS