Hi,
I am processing some logs on a universal forwarder, which then sends the data to some indexers, which are searched from a search-head on a different server. I need to do an extract on the logfiles. Where should the extract statements go? In the props.conf on the receiving indexers, or the search-head?