Overview of event processing
Events are records of activity in log files, stored in Splunk indexes. They are primarily what Splunk indexes. Events provide information about the systems that produce the log files. The term event data refers to the contents of a Splunk index.
Here's a sample event:
172.26.34.223 - - [01/Jul/2005:12:05:27 -0700] "GET /trade/app?action=logout HTTP/1.1" 200 2953
When Splunk indexes events, it:
- Configures character set encoding.
- Configures linebreaking for multi-line events.
- Identifies event timestamps (and applies timestamps to events if they do not exist).
- Extracts a set of useful standard fields such as
- Improves data compression with segmentation.
- Dynamically assigns metadata to events, if specified.
- Anonymizes data, if specified.
For an overview of the Splunk indexing process, see the Indexing with Splunk chapter of the Admin manual.
JMS/JMX - write your own
Configure character set encoding
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7