https://answers.splunk.com/answers/174939/why-are-my-json-fields-extracted-twice.html shows this props.conf entry on the forwarder:
[json_app]
INDEXED_EXTRACTIONS=json
KV_MODE=none
However, this https://kzhendev.wordpress.com/2015/01/19/consuming-json-with-splunk-in-two-simple-steps/ shows this being done on the indexer, with the forwarder just setting the sourcetype on the inputs.conf file. If I have a heavy forwarder taking in the JSON logs and forwarding them, can I just put this props.conf on the forwarder and be done there? I'd assume if the answer is yes that I need to nothing further on the indexer.
You can do this on the heavy forwarder and performance-wise I would recommend doing it on the Heavy Forwarder unless the data is going straight to the indexers (which you said it isn't but just for future reference if that ever happens).
EDIT: Please note that if you are routing your data to multiple groups DO NOT do it on the heavy forwarder tier -- SPL-98594 known issue
Hi wrangler2x, Yup, thats correct. If you have a heavy-forwarder in between your universal-forwarders and indexers, the HF will "cook" those events, and then indexer just writes them to disk.
Please let me know if this answers your question!
Thanks for the confirmation. The two of you have answered my question!
You can do this on the heavy forwarder and performance-wise I would recommend doing it on the Heavy Forwarder unless the data is going straight to the indexers (which you said it isn't but just for future reference if that ever happens).
EDIT: Please note that if you are routing your data to multiple groups DO NOT do it on the heavy forwarder tier -- SPL-98594 known issue
Thanks! That's what I was hoping would be the case.