What Data is the HF Actually Indexes?

[AvivBenSha]

From what I understand about Splunk, it works on the raw data and does not parse it. It does mark and "segments" areas of the data In the tsidx file.

Also from what I understand about HF vs. UF, unlike the universal forwarder, the heavy forwarder does part of the indexing himself. So what exactly does it index? does he segment the raw data to the tsidx file and sends them both to the indexer?

[gcusello]

Hi @AvivBenSha ,

as from its name, Heavy Forwarder forwards data ro the indexers, so it isn't involved in the indexing phase.

In this phase, Indexers store _raw data and index events.

HFs are only involved in the input, merge, typing and parsing phases, not in indexing phases.

Instead UFs are only involved in the input phase, not in the others.

Ciao.

Giuseppe

[richgalloway]

Heavy Forwarders parse data if they are the first full instance to see that data.  It does everything an indexer would do *except* write the data to disk.  HFs do not "index" any data - that's done by indexers.