We are sending cooked ( parsed ) data from the heavy forwarders to the indexer .
We perform some transforms on the heavy forwarders .
We have a few feild extractions defined on the indexers.
Will this still be applied to data sent by the heavy forwarders ?
Hi deepthir,
it depends ©
If it is search time field extraction it will be applied, if they are set on the search head.
A good source to read - SORRY @piebob @ppablo_splunk and all the Splunk Docs Team (But this is still the best page to show this ) - is http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F and you will learn the different configuration option you have.
Hope this helps ...
cheers, MuS