Hello,
Splunk does not recommend using the force_local_processing property unless if you’ve been advised to by someone at Splunk. Switching this property on will potentially increase the cpu and memory consumption of the universal forwarder.
The force_local_processing option, when set to true (set to false, by default) forces a universal forwarder to process all data tagged with a sourcetype locally before forwarding it to the indexers. Data with this sourcetype will be processed via the linebreaker, aggregator and the regexreplacement processors in addition to the existing utf8 processor.
Note that force_local_processing is applicable only on a universal forwarder.
... View more