Manage Splunk Enterprise knowledge

This topic lists common tasks in Splunk software knowledge management and directs you to the relevant topics for understanding and managing knowledge objects, such as events, fields, lookups, and data models.

Splunk Enterprise knowledge

See the Knowledge Manager Manual for more information on using and maintaining knowledge objects.

Task:	Look here:
Understand Splunk Enterprise knowledge objects	What is Splunk knowledge? Understand and use the Common Information Model Add-on
Manage knowledge objects	Monitor and organize knowledge objects Disable or delete knowledge objects

Events and event processing

See the Knowledge Manager Manual for more information on events. See the Getting Data In manual for more information on configuring event processing.

Task:	Look here:
Understand events and event types	About event types Define event types in Splunk Web
Configure event processing	Overview of event processing
Manage event segmentation	About event segmentation

Fields and field extractions

See the Knowledge Manager Manual for more information on fields and field extractions.

Task:	Look here:
Understand fields	About fields Use default fields Configure extractions of multivalue fields with fields.conf About calculated fields
Understand and manage field extractions	About fields When Splunk software extracts fields About Splunk regular expressions

Build data models

See the Knowledge Manager Manual for more information on data models and using the Data Model Editor.

Task:	Look here:
Learn about data models and datasets	About data models
Manage data models and datasets	Manage data models
Use the Data Model Editor	Design data models