How to fix configuration for Cooked data Splunk (UF >> UF >> Indexers)?

[splunk_luis12]

Hi folks,

I have a deployment of UF >> UF >> Indexers sending default data as sendCookedData = true to splunktcp://9997 port but I'm getting data as --splunk-cooked-mode-v3-- 

Any idea of what configuration should I change to not get data in that way? Am I sending cooked data twice? 

Thanks.

[gcusello]

Hi @splunk_luis12,

if you have only Universal Forwarders as intermediate Forwarders, by default, you have uncoocked data.

It's different if you have Heavy Forwarders because you have to configure them to uncook data.

Ciao.

Giuseppe

[splunk_luis12]

Yes, but even though I have only UFs, the data is coming as cooked (splunk-cooked-mode-v3)

Any idea why this happens?

Thanks in advance.

[gcusello]

Hi @splunk_luis12,

are you speaking of sending data from UF -> UF -> IDX, is it correct?

by default you shouldn't have coocked data, but what's the problem?

Having coocked dat is usually a problem only to send them to a third party, if you have only Splunk components it isn't a problem.

Ciao.

Giuseppe