Splunk® Enterprise

Getting Data In

Download manual as PDF

Download topic as PDF

Overview of event processing

Events are records of activity that reside in log files and machine data. They are primarily what Splunk software indexes. Events provide information about the systems that produce the machine data. The term event data refers to the contents of a Splunk index.

Here is a sample event:

172.26.34.223 - - [01/Jul/2005:12:05:27 -0700] "GET /trade/app?action=logout HTTP/1.1" 200 2953

When Splunk software indexes events, it:

For an overview of the indexing process, see the Indexing overview chapter of the Managing Indexers and Clusters manual.

PREVIOUS
Find more data sources to monitor with crawl
  NEXT
Configure character set encoding

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.5.0, 6.5.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters