Could I send uncooked data to a splunk indexer?

[sonicant]

In the document I found:
With raw data, ...... This is particularly useful for sending data to a non-Splunk system.

In my case, the server which forwarder was installed has heavy load, and all the log files are zipped.
So the forwarder has to decompress the packages then read the log files and send data to indexer, this consumes extra CPU time, and leads to slow data forwarding.

So I wonder is there a way to tell the forwarder don't decompress the ZIP packages, just send them to indexer and let indexers do the unzip job?

I tried adding "sendCookedData=false" to inputs.conf and restarted the forwarder, but then the indexer refused the connection from the forwarder....

Thanks for anyone may help!

[Ayn · Accepted solution]

No, regardless of whether the data would be cooked or not, you can't send data from zip files straight away like that. That data is cooked just means (somewhat simplified) that certain metadata is added to the data stream instead of just sending the raw data. It doesn't affect how the events are read from the sources initially.

[Ayn]

That is correct.

[sonicant]

Hi Ayn

Thank you! So there is no way to let forwarder send original zip files to indexer. (Unless using self-made scripts to do the file transferring) Is my understanding right?
And the sendCookedData=false option should only be used when sending data to non-Splunk listener, right?