Where do INDEXED_EXTRACTIONS happen?

[joxley]

I have a Universal Forwarder reading data in a Tab Separated format. I want to apply the INDEXED_EXTRACTIONS = TSV to it.

Do I need to put that on the Indexer or the Forwarder?

A further question is that if the file is being appended to and the top line contains the headers, do I have to wait for the file to be rotated before I'll get the field extractions?

[woodcock · Accepted solution]

You have to put this on every Forwarder and then restart all splunk instances there; read about this caveat here:

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Extractfieldsfromfileheadersatindextime#Caveats