The second segment of the data pipeline. Data arrives at this segment from the input segment. This segment is where event processing occurs (where Splunk Enterprise analyzes data into logical components).
After data is parsed, it moves to the next segment of the pipeline, indexing.
Parsing of external data can occur on either an indexer or a heavy forwarder.
Parsing can also occur on other components under limited circumstances:
In the Distributed Deployment Manual:
In Getting Data In: