Let me know the correct scenario for heavy forwarder if I'm using only forwarding and not indexing and forwarding?
In case of the first scenario is correct, will the TRANSFORMS applies on indexer as well?
Any TRANSFORMS-
setting applies to the first full instance of splunk who handles the event. So if you are using HFs, it will be the HFs, if not, it will be the Indexers.
Any TRANSFORMS-
setting applies to the first full instance of splunk who handles the event. So if you are using HFs, it will be the HFs, if not, it will be the Indexers.
Thanks @woodcock for the answer that make sense. I've also recently verified this by small POC.
Do all parsing happens on HF of there are some config that specifically handles on indexer?
All index-time things will happen on the HF.