Set the segmentation for event data

By default, Splunk software segments events during indexing to allow for the most flexible searching. There are numerous types of segmentation available, and you can create others if necessary. The type of segmentation that you employ affects indexing speed, search speed, and the amount of disk space the indexes occupy. To learn more about segmentation and the trade-offs between the various types of segmentation, refer to "About segmentation".

Splunk software can also segment events at search time. You can set search-time segmentation in Splunk Web, as described in "Set search-time segmentation in Splunk Web".

If you know how you want to search for or process events from a specific host, source, or source type, you can configure index-time segmentation for that specific type of event. You can also configure search-time segmentation options for specific types of events.

Specify segmentation in props.conf

Specify segmentation for events of particular hosts, sources, or source types by assigning segmentation types to the appropriate stanzas in props.conf. In the stanzas, you assign segmentation types, or "rules", that have been defined in segmenters.conf. These can either be predefined types (such as inner, outer, or full), or custom types that you've defined. For more information on defining custom types, read "Configure segmentation types".

The attribute you configure in props.conf to use these types depends on whether you're configuring index-time or search-time segmentation:

• For index-time segmentation, use the SEGMENTATION attribute.
• For search-time segmentation, use the SEGMENTATION-<segment selection> attribute.

You can define either one of the attributes or both together in the stanza.

Add your stanza to $SPLUNK_HOME/etc/system/local/props.conf.

Index-time segmentation

The SEGMENTATION attribute determines the segmentation type used at index time. Here's the syntax:

[<spec>]
SEGMENTATION = <seg_rule>

[<spec>] can be:

• <sourcetype>: A source type in your event data.
• host::<host>: A host value in your event data.
• source::<source>: A source of your event data.

SEGMENTATION = <seg_rule>

• This specifies the type of segmentation to use at index time for [<spec>] events.
• <seg_rule>
  • A segmentation type, or "rule", defined in segmenters.conf
  • Common settings are inner, outer, none, and full, but the default file contains other predefined segmentation rules as well.
  • Create your own custom rule by editing $SPLUNK_HOME/etc/system/local/segmenters.conf, as described in "Configure segmentation types".

Search-time segmentation

The SEGMENTATION-<segment_selection> attribute helps determine the segmentation type used at search time. Here's the syntax:

[<spec>]
SEGMENTATION-<segment_selection> = <seg_rule>

[<spec>] can be:

• <sourcetype>: A source type in your event data.
• host::<host>: A host value in your event data.
• source::<source>: A source of your event data.

SEGMENTATION-<segment_selection> = <seg_rule>

• This specifies the type of segmentation to use at search time in Splunk Web for [<spec>] events.

• <segment_selection> can be one of the following: full, inner, outer, or raw.
  • These four values are the set of options displayed in the Event segmentation dropdown box in the Results display options panel, invoked from Options directly above search results in Splunk Web.
  • Note that these values are just the set of available Splunk Web dropdown options. You use this attribute to specify the actual segmentation type that the option invokes, which might not be of the same name as the dropdown option itself. For example, you could even define the "inner" dropdown option to invoke the "outer" segmentation type, not that you'd likely want to.
  • By mapping the dropdown option to a <seg_rule>, a user can later specify the option when looking at search results to set search-time segmentation, as described in "Set search-time segmentation in Splunk Web".

• <seg_rule>
  • A segmentation type, or "rule", defined in segmenters.conf
  • Common settings are inner, outer, none, and full, but the default file contains other predefined segmentation rules as well.
  • Create your own custom rule by editing $SPLUNK_HOME/etc/system/local/segmenters.conf, as described in "Configure segmentation types".

Example

This example sets both index-time and search-time segmentation rules for syslog events.

Add the following to the [syslog] source type stanza in props.conf:

[syslog]
SEGMENTATION = inner
SEGMENTATION-full= inner

This stanza changes the index-time segmentation for all events with a syslog source type to inner segmentation. It also causes the full radio button in Splunk Web to invoke inner segmentation for those same events.

Note: You must restart Splunk Enterprise to apply changes to search-time segmentation. You must re-index your data to apply index-time segmentation changes to existing data.