What is the distinction between parsed , unparsed , and raw data?

[Steve_G_]

What processsing does the light forwarder do when sending unparsed data, to distinguish what it does with raw data? Similarly, what further processing does a regular forwarder perform when sending parsed data?

[ddarmand]

Does rawdata are lighter ?

[Steve_G_]

per gkanapathy:

raw is not at all touched by splunk, usually only used for forwarding syslog to non-splunk systems, etc.

unparsed cooked data is raw data that has been "enhanced" with Splunk-specific information about the source of the data, e.g., host name, destination index, sourcetype, source. (incidentally, these pieces of info are sometimes called "keys"). The common thing about these pieces of data is they apply to the source/input as a whole and do not vary with individual events. In fact, in unparsed data, individual events have not even necessarily been identified.

parsed/cooked data has had each individual event examined and annotated with the keys, plus new fields and key values that may be different in each individual event. The raw data has been broken down into separate lines, the lines may have been read, merged into multi-line events, the resulting events read by the transforms processor, and various indexed field values set or overridden event by event.

See this too:

http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F