A Universal Forwarder is collecting two separate sources of data (A,B). Source A is being routed through a Heavy Forwarder and then to an indexer. Source B is being routed directly to the indexer. Bot

Placing masking configs on the indexer and search head is wrong because Source A is already parsed at the Heavy Forwarder before reaching the indexer, meaning indexer-side masking is applied too late to affect Source A's data.

Placing props.conf only on the indexer for Source A is insufficient because the Heavy Forwarder performs parsing for that data path, and both props.conf and transforms.conf are required together for masking to function.

Universal Forwarders do not execute the parsing pipeline and therefore cannot apply props.conf or transforms.conf masking transforms - they only forward raw, unprocessed data to the next tier.

Splunk's SEDCMD and TRANSFORMS-based masking is applied during the parsing pipeline, which runs on the first full parsing component a data stream passes through. Source A is parsed at the Heavy Forwarder, so props.conf and transforms.conf must reside on the Heavy Forwarder to mask that data before it reaches the indexer; Source B is parsed at the indexer directly, so those same files must also be placed on the indexer for Source B.