server

noun

In the Splunk context, a somewhat ambiguous term (best avoided), usually used to refer to an indexer or, generally, to any Splunk instance. It can also mean a deployment server. And, of course, the term might well refer to an external server (e.g., a database server) providing raw data to Splunk. Remember: Context is everything!

To avoid confusing your peers, qualify this term if you use it. Acceptable: "the deployment server", "the database server". Not so acceptable: "the Splunk server" -- use the specific type of Splunk instance, such as "indexer", if possible. Totally unacceptable: "the server".

For more information

In the Installation Manual:

In the Admin Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time