A customer has a Universal Forwarder (UF) with an inputs.

This is because the index time parsing occurs on the Splunk instance that performs the parsing pipeline, which is the heavy forwarder in this case. The parsing pipeline is the process of breaking the incoming data into events, extracting default fields and timestamps, and applying transforms. The heavy forwarder is a type of Splunk forwarder that can perform the parsing pipeline on the data before forwarding it to the indexer. The universal forwarder is a type of Splunk forwarder that does not perform the parsing pipeline, but only forwards the raw data to another Splunk instance. The indexer is a Splunk instance that receives the parsed data from the heavy forwarder and performs the indexing pipeline, which is the process of compressing, encrypting, and writing the data to disk. The search head is a Splunk instance that coordinates searches across multiple indexers and displays the results to the user.

The other options are incorrect because they are not the Splunk instances that perform the index time parsing in this scenario. Option A is incorrect because the indexer does not perform the index time parsing, but only receives the parsed data from the heavy forwarder. Option B is incorrect because the universal forwarder does not perform the index time parsing, but only forwards the raw data to the heavy forwarder. Option C is incorrect because the search head does not perform the index time parsing, but only coordinates searches across multiple indexers. References:

Splunk Core Consultant knowledge source documents or study guide: https://www.splunk.com/en_us/resources/splunk-certification-exam-study-guide.html

Splunk Test Blueprint Consultant: https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-consultant.pdf

How indexing works1

About forwarding and receiving data2

About Splunk Enterprise instances3