According to the Splunk documentation1, event processing occurs at the parsing phase of the data pipeline. The parsing phase is where Splunk software processes incoming data into individual events, extracts timestamp information, assigns source types, and performs other tasks to make the data searchable1. The parsing phase can also apply field extractions, event type matching, and other transformations to the events2.

https://docs.splunk.com/Documentation/Splunk/8.1.2/Security/Dataintegritycontrol#:~:text=When%20you%
20enable%20data%20integrity%20control%2C%20Splunk%20Enterprise%20computes%20hashes,it%20to%
20a%20l1Hashes%20file.
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Dataintegritycontrol

https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Aboutforwardingandreceivingdata
https://docs.splunk.com/Documentation/Forwarder/8.1.1/Forwarder/Configureforwardingwithoutputs.conf#:~:
text=compressed%3Dtrue%20This%20tells%20the,the%20forwarder%20sends%20raw%20data.

Reference:https://docs.splunk.com/Documentation/Forwarder/8.2.1/Forwarder/Configureloadbalancing