so,
if i don't configure parsing, my HF will parse my data with default parsing, right? Because the HF is a full splunk enterprise instance that comes with a default props.conf and transforms.conf, isn't it?
for example;
Host A: this is the machine that i want to get its logs. a web server for example.
Splunk Cloud: My indexer.
I want to parse my data in Host A and splunk cloud must only index them. not parsing.
In this situation,
Only I have to enable forwarding HF in Host A and that's all, right? because the props.conf and transforms.conf files already exist.
... View more