event renderer

noun

The way events are displayed in Splunk Web is due to the event rendering engine. If you work with audit events, you'll notice that these events are rendered in a different way from other events. Namely, audit events have decorations next to them that show whether or not they've been tampered with and how secure they are. You can create your own custom event renderer that will display events differently based on the event types in your results.

For more information

In the Developer Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time