Where is the proper place to use INDEXED_EXTRACTIONS = JSON -- the indexer or a heavy forwarder?

[wrangler2x]

https://answers.splunk.com/answers/174939/why-are-my-json-fields-extracted-twice.html shows this props.conf entry on the forwarder:

[json_app]
INDEXED_EXTRACTIONS=json
KV_MODE=none

However, this https://kzhendev.wordpress.com/2015/01/19/consuming-json-with-splunk-in-two-simple-steps/ shows this being done on the indexer, with the forwarder just setting the sourcetype on the inputs.conf file. If I have a heavy forwarder taking in the JSON logs and forwarding them, can I just put this props.conf on the forwarder and be done there? I'd assume if the answer is yes that I need to nothing further on the indexer.

[muebel]

Hi wrangler2x, Yup, thats correct. If you have a heavy-forwarder in between your universal-forwarders and indexers, the HF will "cook" those events, and then indexer just writes them to disk.

Please let me know if this answers your question!

[wrangler2x]

Thanks for the confirmation. The two of you have answered my question!

[ryandg · Accepted solution]

You can do this on the heavy forwarder and performance-wise I would recommend doing it on the Heavy Forwarder unless the data is going straight to the indexers (which you said it isn't but just for future reference if that ever happens).

EDIT: Please note that if you are routing your data to multiple groups DO NOT do it on the heavy forwarder tier -- SPL-98594 known issue

[wrangler2x]

Thanks! That's what I was hoping would be the case.