Documentation > Splunk > Admin Manual > Configuration parameters and the data pipeline

Admin Manual

 


Welcome to Splunk administration
What to do first
Use Splunk Web
Getting started for Windows admins
Manage Splunk licenses
Meet Splunk apps
Configure Splunk
Indexing with Splunk
Manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference

Configuration parameters and the data pipeline

Contents

Configuration parameters and the data pipeline

Data goes through several phases as it transitions from raw input to searchable events. This process is called the data pipeline and consists of four phases:

The Distributed Deployment manual describes the data pipeline in detail, in "How data moves through Splunk: the data pipeline". Then, in "Components and roles", it describes how the various Splunk components, such as forwarders and indexers, correlate to the different phases of the pipeline. For instance, the input phase is handled by either a forwarder or an indexer; the search phase is handled by either an indexer or a search head.

Key configuration file parameters are associated with specific phases of the data pipeline. Knowing which phase a parameter acts upon can help you to understand better what exactly the parameter does. It also allows you to quickly identify where in your Splunk topology you need to set the parameter -- on which particular Splunk component. For example, if a search head is handling search in your topology, then you need to set search-related parameters on that search head and not on your indexers.

Which configuration parameters go with which phases

This is a non-exhaustive list of which configuration parameters go with which phase. By combining this information with an understanding of your topology and specifically which Splunk component is handling each particular phase, as described in "Components and roles" in the Distributed Deployment manual, you can determine which component needs the setting.

Input

Parsing

Indexing

Search

Other

There are some settings that don't work well in a distributed Splunk environment. These tend to be exceptional and include:

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/Configurationparametersandthedatapipeline"

This documentation applies to the following versions of Splunk: 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!