Splunk® Style Guide

Splunk Style Guide

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Splunk product terminology

Splunk docs use standard terms and definitions for Splunk software, certain combinations of Splunk software, and parts of Splunk product architecture. When used alone, "Splunk" refers only to the company, not to any product. Don't use "Splunk" in the possessive form.

Follow these usage guidelines to choose the correct term when you write about Splunk software.

The Splunk platform and Splunk software

Use the Splunk platform to refer to both Splunk Cloud Platform and Splunk Enterprise. Don't capitalize the "p" in "platform", and make sure you include a definite article.

The Splunk platform
the Splunk platform
The Splunk Platform
Splunk platform

Use Splunk software to refer to anything and everything the company offers. Don't capitalize the "s" in "software", and don't include a definite article.

Splunk software
The Splunk software
The Splunk Software
the Splunk Software
Splunk Software

You can use "the Splunk platform" as a modifier. Avoid using "Splunk" as a modifier by itself when you are referring to a specific instance where the Splunk platform is installed, Splunk platform deployments, or the environment in which the Splunk platform is running.

Restart the Splunk platform instance...
In a distributed Splunk platform deployment...
In your Splunk platform environment...
Splunk platform server
Splunk server
Splunk deployment
Splunk instance
Splunk environment
Splunk implementation

Product suites

Splunk offers the following cloud-only product suites:

  • Splunk IT Cloud
  • Splunk Security Cloud
  • Splunk Observability Cloud

When referring to these offerings, don't use the definite article "the" in front of the product name. After the first use in a heading and the first reference in paragraph text, you can remove "Splunk" to shorten the name. Don't use a three-letter acronym such as SIT, SSC, or SOC to refer to these offerings.

If necessary, distinguish between the entitlement tiers by adding the tier name after the product name, as in the following examples:

  • Splunk Observability Cloud Standard includes Splunk Infrastructure Monitoring, Splunk APM, and Splunk Log Observer.
  • Splunk Observability Cloud Plus includes all the components of Observability Cloud Standard with the addition of Splunk Real User Monitoring.
Splunk Observability Cloud
Observability Cloud
Splunk Observability Cloud Standard
Splunk IT Cloud
The Splunk Observability Cloud
The Observability Cloud
The Splunk IT Cloud

Choose the most specific and accurate term in each situation

When considering what noun to use when referring to a Splunk product, always use the most specific and accurate term that is appropriate for the situation. For example, you can refer to a product using a specific node or service of the product, such as a search head or deployment server. If you need a more general term, refer to the product by its product name, such as Splunk Enterprise or Splunk Cloud Platform, or its product category, such as the Splunk platform. If you must refer to both a platform product and an app, you can use the most general term, "Splunk software". The following diagram shows the level of specificity for Splunk product terms:

Diagram showing the types of Splunk product terms you can use, organized by specificity. Described under the heading called Choose the most specific and accurate term in each situation.

Use these guidelines to determine which term to write:

  • If you're thinking about using Splunk Enterprise or Splunk Cloud Platform, consider whether a specific node of the product, like the search head, the indexer cluster, Splunk Web, the data collection node, the deployment server, the forwarder, and so on, is more helpful for customers.
  • When you are referring to a specific platform product, name it.
  • When you are referring to an app, name the app or write "the app".
  • When you are referring to Splunk Cloud Platform or Splunk Enterprise but you don't know which product the user has, write "the Splunk platform". This is common.
  • Use "Splunk software" only when you are referring to one or more platform products plus one or more apps, or when either a core product or an app could be the subject. This is the rarest case.


Here are examples of Splunk product terms in a sentence with an explanation of why the term in bold is the best term to use:

Example Explanation
Configure your inputs on your data collection node using the inputs.conf file or Splunk Web. The most specific and accurate term here is the node on which the configuration takes place.
The performance of this application is dependent on a variety of factors, including the other Splunk apps that you have installed on the same search head. Because this sentence is about search head performance, the node (search head) is the most specific and accurate term in this situation. Also, "Splunk apps" is the most specific and accurate term rather than "Splunk software" because because apps and not the core product are what users can install on a search head.
This manual discusses high-level hardware guidance for Splunk Enterprise deployments and describes how Splunk Enterprise uses hardware resources in different situations. The Capacity Planning Manual applies only to Splunk Enterprise, so you can be specific and name the product.
The Splunk Datasets Add-on, available from Splunkbase, gives Splunk Enterprise users additional dataset management capabilities. Splunk Cloud Platform users have the Splunk Datasets Add-on by default. ... In previous versions of the Splunk platform, data model datasets were called data model objects. The initial entry point for this feature is different in Splunk Enterprise and Splunk Cloud Platform, so the writer makes that clear up front by using the product names. For the remainder of the documentation, "the Splunk platform" is appropriate because it includes both Splunk Enterprise and Splunk Cloud Platform.
Metrics is a feature of the Splunk platform. The metrics feature is available for Splunk Cloud Platform and Splunk Enterprise, so the Metrics manual uses "the Splunk platform" to be inclusive of all platform types.
Splunk IT Service Intelligence uses the access control system integrated with the Splunk platform. You don't know whether the customer is administering ITSI on Splunk Enterprise or Splunk Cloud Platform, so use "the Splunk platform" here to be inclusive of both.
Splunk Education offers a variety of courses and certification programs to help make you more productive with Splunk software. Splunk Education courses cover some premium apps as well as core product offerings, so using "Splunk software" is appropriate here.
If you have questions about the licenses that apply to the Splunk software you are using, contact Splunk Support. Some apps also have separate licenses and entitlements, so this more general term is appropriate here.

Still not sure which term to use?

Try these steps:

  1. First, try to name the specific node or product. If that level of precision is appropriate, use that term.
  2. If the specific node or product name isn't appropriate, try using "the Splunk platform". When you use "the Splunk platform" in the sentence, can you replace it with at least one of the following things and have the sentence still make sense?
    • "Splunk Enterprise or Splunk Cloud Platform"
    • "your forwarder or your single-instance deployment"
    If yes, use "the Splunk platform".
  3. If "the Splunk platform" doesn't make sense, try using "Splunk software". When you use "Splunk software" in the sentence, can you replace it with at least one of the following things and have the sentence still make sense?
    • "the Splunk platform or a Splunk app"
    • "the Splunk platform or Splunk apps"
    • "the Splunk platform or some Splunk apps"
    • "Splunk Enterprise or Splunk apps"
    • "Splunk Enterprise or some Splunk apps"
    • "Splunk Cloud Platform or cloud-supported Splunk apps"
    If yes, use "Splunk software". If no, ask the editing team for advice.
Last modified on 30 July, 2021
Special characters
Splunk Web terminology

This documentation applies to the following versions of Splunk® Style Guide: current

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters