You say you didn’t have a TA (props and transforms on the HF before), normally as the HF is full Splunk instances you should have the TA there for parsing, also known as cooked data and before it rea...
See more...
You say you didn’t have a TA (props and transforms on the HF before), normally as the HF is full Splunk instances you should have the TA there for parsing, also known as cooked data and before it reaches the indexer, if you was sending direct then the TA on Indexer will suffice. (Why it worked before the upgrade I don’t know, but the as to the upgrade path, you should always follow the path, as this can often introduce breaking changes, so could be a factor. I would try to deploy your custom TA(props code) onto the HF and see if that makes a difference, as you already have this TA deployed to the current SH/IDX, you should be able to continue with normal field extractions, once it sees the sourcetype. So, ensure the code for this data source lives perhaps in a custom TA or copy the code as it is in the SH/IDX and config or deploy that to the HF + restart. Tip for consistency keep the code in one Custom TA app is best practise, otherwise use /local/props.conf.