Splunk® Enterprise

Splunk Enterprise Overview

Acrobat logo Download manual as PDF

Splunk Enterprise version 7.1 is no longer supported as of October 31, 2020. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Acrobat logo Download topic as PDF

Manage Splunk Enterprise knowledge

This topic lists common tasks in Splunk software knowledge management and directs you to the relevant topics for understanding and managing knowledge objects, such as events, fields, lookups, and data models.

Splunk Enterprise knowledge

See the Knowledge Manager Manual for more information on using and maintaining knowledge objects.

Task: Look here:
Understand Splunk Enterprise knowledge objects

What is Splunk knowledge?

Understand and use the Common Information Model Add-on

Manage knowledge objects

Monitor and organize knowledge objects

Disable or delete knowledge objects

Events and event processing

See the Knowledge Manager Manual for more information on events. See the Getting Data In manual for more information on configuring event processing.

Task: Look here:
Understand events and event types

About event types

Define event types in Splunk Web

Configure event processing Overview of event processing
Manage event segmentation About event segmentation

Fields and field extractions

See the Knowledge Manager Manual for more information on fields and field extractions.

Task: Look here:
Understand fields

About fields

Use default fields

Configure extractions of multivalue fields with fields.conf

About calculated fields

Understand and manage field extractions

About fields

When Splunk software extracts fields

About Splunk regular expressions

Build data models

See the Knowledge Manager Manual for more information on data models and using the Data Model Editor.

Task: Look here:
Learn about data models and datasets About data models
Manage data models and datasets Manage data models
Use the Data Model Editor Design data models
Last modified on 23 July, 2018
Search and reporting
Customize and extend Splunk Enterprise

This documentation applies to the following versions of Splunk® Enterprise: 6.5.7, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters