Splunk® Enterprise

Search Manual

Download manual as PDF

Download topic as PDF

Event segmentation and searching

When data is added to your Splunk instance, the indexer looks for segments in the data. Data is segmented by separating terms into smaller pieces, first with major breakers and then with minor breakers.

Suppose an event begins with an IP address and a date, such as 91.205.189.16 - - [13/Aug/2019:18:22:16] . This data is broken into these segments based on the major breakers:

91.205.189.15
-
[13/Aug/2019:18:22:16]  

These major segments are further broken down based on the minor breakers. For example, the IP address is broken into minor segments such as 91, as well as groups of minor segments like 19.205.189.

Event segmentation occurs at index-time and at search-time.

  • Index-time segmentation affects indexing and search speed, storage size, and the ability to use typeahead functionality in the Search bar in Splunk Web.
  • Search-time segmentation affects search speed and the ability to create searches by selecting items from the results displayed in Splunk Web.

Searching and punctuation

Many punctuation symbols are interpreted as major or minor breakers in event data.

NEED WHY ITS A PROBLEM

Major breakers

Major breakers are a set of characters that are used to divide words, phrases, or terms in the event data into large tokens. Examples of major breakers are:

  • A space
  • A newline
  • A tab
  • Square brackets [ ]
  • Parenthesis ( )
  • Curly brackets { }
  • An exclamation point  !
  • A semicolon ;
  • A comma ,
  • Single and double quotation marks ' "
  • The ampersand sign &


Here is an example of part of an event:


91.205.189.15 - - [13/Aug/2019:18:22:16] "GET /oldlink?itemId=EST-14&JSESSIONID=SD6SL7FF7ADFF53113 HTTP 1.1" 

This partial example gets segmented on the major breakers into the following tokens:

91.205.189.15
-
-
[13/Aug/2019:18:22:16] 
GET
/oldlink?itemId=EST-14
JSESSIONID=SD6SL7FF7ADFF53113
HTTP
1.1

Minor breakers

Minor breakers are a set of characters that are used to further divide large tokens into smaller tokens.

Examples of minor breakers are:

  • A period .
  • A forward slash /
  • A double backslash \\
  • A colon :
  • The equal sign =
  • The AT symbol @
  • The hash or pound symbol #
  • The ampersand symbol &
  • The dollar sign $
  • The percent symbol %
  • The dash symbol -
  • The underscore symbol _



Splunk Administers

For a complete list of segmenters, see admin guide, segmenters.conf


Major segments. An IP address such as 192.0.2.223 is a major segment. But this major segment can be broken down into minor segments, such as "192", as well as groups of minor segments like "192.0.2". Minor segments are breaks within major segments. For example,

You can define how detailed the event segmentation should be. This is important because index-time segmentation affects indexing and search speed, storage size, and the ability to use typeahead functionality (where Splunk Web provides items that match text you type into the Search bar). Search-time segmentation, on the other hand, affects search speed and the ability to create searches by selecting items from the results displayed in Splunk Web.

For more information about the distinction between "index time" and "search time," see "Index time versus search time" in the Managing Indexers and Clusters manual.

You can assign segmentation to specific categories of events in props.conf, as described in "Set the segmentation for event data".

If you have Splunk Enterprise, you configure index-time segmentation on the indexer or heavy forwarder machines, and search-time segmentation on the search head.

If you have Splunk Cloud, you configure index-time segmentation on heavy forwarder machines, and must file a Support ticket to configure search-time segmentation.

Links https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Segmentersconf https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Abouteventsegmentation

PREVIOUS
Difference between NOT and !=
  NEXT
Use CASE() and TERM() to match phrases

This documentation applies to the following versions of Splunk® Enterprise: 8.0.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters