Let me know the correct scenario for heavy forwarder if I'm using only forwarding and not indexing and forwarding?
1. Heavy forwarder applies the TRANSFORMS (including nullQueue and other) and it sends the **transformed data** to indexer.
2. Heavy forwarder sends the **_raw data only** to indexer and TRANSFORM will only happens if I'm using IndexAndForward.
In case of the first scenario is correct, will the TRANSFORMS applies on indexer as well?
↧