Please enable JavaScript.

Coggle requires JavaScript to display documents.

Splunk (indexer (search heads (Forwarder (little resources (resides on…

- - - - instances that consume and send data to index
      - little resources
        
        resides on machines
    - - knowledge objects located
- - - - files and directories
        
        network data
        
        script output
        
        windows logs
        
        http
      - Metadata
        
        applied to entire source
        
        source - path of input file
        
        host - inputting instance
        
        sourcetype
        
        index
        
        Permissions
        
        Fields
        
        searchable key/pairs
        
        interesting occur in at least 20%
        
        Names are case sensitive
        
        1 more item...
        
        default 10 mins, exteneded to 7 days for jobs
    - - handled at source
        
        data sources are opened/read
    - - indexers
        
        broken into events and processing performed
    - - license meter runs as data and is written to disk
        
        data cant be changed
  - - - coordinate activities to handle search requests and distribute across indexers
  - - - prevent data loss
        
        availability
        
        manage mulitple indexers
    - - simple mgmt
        
        no data recovery
- - - - same searches multiple times
        
        splunk app to present/manipulate data
        
        rawdata 10% of incoming data
        
        index can range from 10-110% of size of rawdata file dependent on unique terms
- - - - Wildcards
        
        beginning - all events within time
        
        middle inconsistent
        
        Search Job inspector
        
        overall stats of search
        
        how search was processed
        
        where splunk spent it's time
        
        use to troubleshoot search's performance and knowledge objects on processing
        
        header
        
        execution costs
        
        search job properties
      - events come into hot bucket
        
        they age to warm, then cold
        
        bucket has raw/meta/index files
        
        meta tracks source/sourcetype/host
        
        splunk searches by time range
    - - command clauses
        
        search terms
        
        stat functions
        
        field values
  - - - regular expressions
        
        eval and where commands
        
        tags