is there any way to process data with a heavy forwarder and then send the formatted data uncooked?

[Log_wrangler]

I have raw data that I need to parse / break per event time stamp but I need to send it uncooked (with the event breaks) to a NiFi listener node...

I don't believe this is possible....

Please confirm.
Thank you

[harsmarvania57 · Accepted solution]

Hi @Log_wrangler,

I believe the same that this is not possible because when you send uncooked data to 3rd party, splunk will send raw data without processing it so in this case you can't break events on those data I guess.

[Log_wrangler]

agreed, its incompatible... thanks.

[mstjohn_splunk]

hi @log_wrangler

If this is the correct answer to your question, would you mind approving it? That way, other users can learn from this query. Thanks!