How to split cooking data and routing between two (or more) forwarders?

[MMCC]

Hi all,

I have already read several interesting questions regarding this topic. I'd like to verify which approach is better.

This wiki entry really helps: https://wiki.splunk.com/Community:HowIndexingWorks
(topic 4. Detail Diagram - UF/LWF to Indexer)

Goal: Routing of the data to the indexer layer / specific indexer (Indexer S)
Issue: First forwarder can't communicate with the indexer directly (e.g. security etc.)

I see now two options.

Option A:
I perform nothing with the data on the first (or more) forwarders until I reach the forwarder connected to the IX layer.
-> so to speak pass through the data "raw"

Option B:
I cook the data on the first forwarder and on following forwarders I configure the next "queue" to be "typingQueue".
Which should enable the routing capability of each following forwarder in the line.

See following picture below for details:

Which approach seems more feasible?

Thank you in advance for any hints and remarks.

Ps. Good input was found here:
https://answers.splunk.com/answers/463643/does-cooked-data-from-a-hf-forwarder-automatically.html

https://answers.splunk.com/answers/97918/reparsing-cooked-data-coming-from-a-heavy-forwarder-possibl...

https://answers.splunk.com/answers/548367/definitions-of-the-route-keys-and-queuenames-for-s.html

[richgalloway]

I recommend Option A. Have universal forwarders on endpoints send data to heavy forwarders which pass it on to the indexers.

[MMCC]

Thank you for the fast reply! I'll further look into Option A.

Do you have any experience with "structured data"?

They seem to be quite special:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Extractfieldsfromfileswithstructureddata

[richgalloway]

Please ask that in a new question.