Book Image

Mastering Splunk

By : James D. Miller
Book Image

Mastering Splunk

By: James D. Miller

Overview of this book

Table of Contents (18 chapters)
Mastering Splunk
About the Author
About the Reviewers

What does Splunk do with the data it monitors?

By now, you know that you input raw data into Splunk, but do you know what Splunk Enterprise does with your data and how to make it do this in a better way?

What Splunk does is it indexes your data, making it searchable knowledge (in the form of events). Moving from data inputs to searchable knowledge is known as the Splunk data pipeline process.

The Splunk data pipeline

So, let's take a quick look at the Splunk data pipeline.

Once new data inputs are configured, Splunk picks up the new data that is generated and drops it into its parsing queue, where it waits for parsing to be done. This parsing includes the following:

  • Source and event typing

  • Character set normalization

  • Line termination identification

  • Timestamp identification and normalization

  • Event boundary identification

  • Regex transformation and parse-time field creation

After being sent through the Splunk parser, the data goes to an indexing queue where it waits for the Splunk indexer. The indexer...