Splunk Search

INDEXED_EXTRACTIONS after data passed through a Universal Forwarde



I have a UF that will send the data to another UF. I want to send the data uncooked to the second UF, and only then, to do the INDEXED_EXTRACTIONS of csv.

As Splunk Documentation says, Forwarded data skips the following queues on the indexer, which precludes any parsing of that data on the indexer:

  • parsing
  • aggregation
  • typing

So how can I force the data to go through the parsing queue again in order to make de extractions only on UF2?

Is there a place where I can find the syntax for route=has_key etc... ?

Thanks in advance

0 Karma


Yes I am aware of the options in search time and index time. I really need to make some comparisons so Could you please tell me how to do that on my own account?

What is the syntax of route has_key? What are all the queues that can be specified there? Is structuredparsing the name of the queue where indexed extractions are done?


0 Karma


Why do you need indexed extractions? You could do search-time field extractions on the indexer (or search head if you are using a search head). This would avoid the whole problem, and is usually better than indexed extractions.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...