As data enters the indexer, it proceeds through a pipeline where event processing occurs. In which pipeline does line breaking occur?
As data enters the indexer, it proceeds through a pipeline where event processing occurs. In which pipeline does line breaking occur?
Line breaking is part of the parsing process in the event processing pipeline. During the parsing phase, the incoming data is analyzed and broken down into individual events, which involves breaking the lines. This is an essential step to properly index the data for efficient searching and retrieval.
D is the correct
Ref: CI Notes p. 230
see https://docs.splunk.com/Documentation/Splunk/9.1.3/Indexer/Howindexingworks#Event_processing_and_the_data_pipeline