Getting Data In

Where is the proper place to use INDEXED_EXTRACTIONS = JSON -- the indexer or a heavy forwarder?

wrangler2x
Motivator

https://answers.splunk.com/answers/174939/why-are-my-json-fields-extracted-twice.html shows this props.conf entry on the forwarder:

[json_app]
INDEXED_EXTRACTIONS=json
KV_MODE=none

However, this https://kzhendev.wordpress.com/2015/01/19/consuming-json-with-splunk-in-two-simple-steps/ shows this being done on the indexer, with the forwarder just setting the sourcetype on the inputs.conf file. If I have a heavy forwarder taking in the JSON logs and forwarding them, can I just put this props.conf on the forwarder and be done there? I'd assume if the answer is yes that I need to nothing further on the indexer.

0 Karma
1 Solution

ryandg
Communicator

You can do this on the heavy forwarder and performance-wise I would recommend doing it on the Heavy Forwarder unless the data is going straight to the indexers (which you said it isn't but just for future reference if that ever happens).

EDIT: Please note that if you are routing your data to multiple groups DO NOT do it on the heavy forwarder tier -- SPL-98594 known issue

View solution in original post

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi wrangler2x, Yup, thats correct. If you have a heavy-forwarder in between your universal-forwarders and indexers, the HF will "cook" those events, and then indexer just writes them to disk.

Please let me know if this answers your question!

0 Karma

wrangler2x
Motivator

Thanks for the confirmation. The two of you have answered my question!

0 Karma

ryandg
Communicator

You can do this on the heavy forwarder and performance-wise I would recommend doing it on the Heavy Forwarder unless the data is going straight to the indexers (which you said it isn't but just for future reference if that ever happens).

EDIT: Please note that if you are routing your data to multiple groups DO NOT do it on the heavy forwarder tier -- SPL-98594 known issue

View solution in original post

0 Karma

wrangler2x
Motivator

Thanks! That's what I was hoping would be the case.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.