A searchable part of an event. Splunk Enterprise breaks events into segments, a process known as "segmentation," at index time and at search time.
Segmentation is highly configurable. Index-time segmentation affects indexing and search speed, disk compression, and the ability to use typeahead functionality. Search-time segmentation affects search speed and the ability to create searches by selecting items from search results.
For more information
In Getting Data In: