Does TRANSFORMS applies on Heavy Forwarder or on Indexer?

[VatsalJagani]

Let me know the correct scenario for heavy forwarder if I'm using only forwarding and not indexing and forwarding?

1. Heavy forwarder applies the TRANSFORMS (including nullQueue and other) and it sends the transformed data to indexer.
2. Heavy forwarder sends the _raw data only to indexer and TRANSFORM will only happens if I'm using IndexAndForward.

In case of the first scenario is correct, will the TRANSFORMS applies on indexer as well?

[woodcock · Accepted solution]

Any TRANSFORMS- setting applies to the first full instance of splunk who handles the event. So if you are using HFs, it will be the HFs, if not, it will be the Indexers.

[VatsalJagani]

Thanks @woodcock for the answer that make sense. I've also recently verified this by small POC.

Do all parsing happens on HF of there are some config that specifically handles on indexer?

[woodcock]

All index-time things will happen on the HF.