Documentation > Splunk > Admin Manual > Overview of event processing

Admin Manual

 


Welcome to Splunk administration
What to do first
Use Splunk Web
Meet Splunk apps
Configure Splunk
Indexing with Splunk
Add data and configure inputs
Set up forwarding and receiving
Configure event processing
Configure event timestamping
Configure indexed field extraction
Manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Deploy to other Splunk instances
Set up distributed search
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference
Troubleshooting

Overview of event processing

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Overview of event processing

Events are records of activity in log files, stored in Splunk indexes. They are primarily what Splunk indexes. Events provide information about the systems that produce the log files. The term event data refers to the contents of a Splunk index.

Here's a sample event:

172.26.34.223 - - [01/Jul/2005:12:05:27 -0700] "GET /trade/app?action=logout HTTP/1.1" 200 2953

When Splunk indexes events, it:

For an overview of the Splunk indexing process, see the Indexing with Splunk chapter of this manual.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.1.5/Admin/Overviewofeventprocessing"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!