
Overview of event processing
Events are records of activity in log files and machine data. They are primarily what Splunk Enterprise indexes. Events provide information about the systems that produce the machine data. The term event data refers to the contents of a Splunk index.
Here is a sample event:
172.26.34.223 - - [01/Jul/2005:12:05:27 -0700] "GET /trade/app?action=logout HTTP/1.1" 200 2953
When Splunk Enterprise indexes events, it:
- Configures character set encoding.
- Configures linebreaking for multi-line events.
- Identifies event timestamps (and applies timestamps to events if they do not exist).
- Extracts a set of useful standard fields such as
host
,source
, andsourcetype
. - Segments events.
- Dynamically assigns metadata to events, if specified.
- Anonymizes data, if specified.
For an overview of the Splunk Enterprise indexing process, see the Indexing overview chapter of the Managing Indexers and Clusters manual.
PREVIOUS Find more things to monitor with crawl |
NEXT Configure character set encoding |
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15
Feedback submitted, thanks!