segment

noun

A searchable part of an event. Splunk breaks events into segments, a process known as "segmentation", at index time and at search time.

Segmentation is highly configurable. Index-time segmentation affects indexing and search speed, disk compression, and the ability to use typeahead functionality. Search-time segmentation affects search speed and the ability to create searches by selecting items from search results.


For more information

In the Getting Data In Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time