Splunk product terminology

Splunk docs use standard terms and definitions for Splunk software, certain combinations of Splunk software, and parts of Splunk product architecture. Follow these usage guidelines to choose the correct term when you write about Splunk software.

As a best practice, when considering what noun to use when referring to a Splunk product, always use the most specific and accurate term that is appropriate for the situation. Refer to the following table for examples of terms you can choose from:

Type of term	Examples
Component or service	Search head Deployment server
Product name	Splunk Enterprise Splunk Cloud Platform Splunk Observability Cloud Splunk AppDynamics Splunk Application Performance Monitoring Splunk IT Service Intelligence (ITSI) Splunk Enterprise Security (ES)
Product abbreviation	ITSI ES
Product category	The Splunk platform Splunk Observability Apps and add-ons
A combination of Splunk products and categories	Splunk software

Splunk terminology reference

The following table compiles the basic definitions and examples for commonly used terms in the Splunk lexicon. For extended definitions and guidance, refer to the rest of the topic.

Term	Definition	Guidance	Examples
Splunk	When used alone, refers only to the company, not to any product.	See Splunk by itself.	Splunk customer Splunk has a mascot named Buttercup.
Splunk software	Refers to any combination of Splunk Enterprise, Splunk Cloud Platform, any Splunk-supported apps and add-ons, and any other software produced by Splunk.	See Splunk software.	Splunk software extracts different kinds of knowledge from your data.
The Splunk platform	Refers to both Splunk Enterprise and Splunk Cloud Platform.	See The Splunk platform.	Restart the Splunk platform. Each Splunk platform instance requires a license.
Splunk Observability	Refers to both the Splunk Observability Cloud and Splunk AppDynamics products, and is a category separate from the Splunk platform product offerings.	See Splunk Observability.	Splunk Observability provides transparent usage data with detailed reports on all monitored hosts, containers, and metrics.

Splunk by itself

When used alone, "Splunk" refers only to the company, not to any product. When using the word "Splunk", follow these conventions:

• Don't use "Splunk" in the possessive form, which can dilute the trademark. See Trademark attribution.
• Don't use "Splunk" as a noun if you want to describe a product.
• Don't use "Splunk" as a verb to describe an action.
• Avoid using "Splunk" as a modifier by itself when you are referring to a specific instance where the Splunk platform is installed, Splunk platform deployments, or the environment in which the Splunk platform is running. See The Splunk platform.

The following examples are correct uses of "Splunk" by itself because they refer to the company and not to a specific product:

• A Splunk customer
• Splunk has a mascot named Buttercup.

Review the following table for examples of how to rewrite sentences that have the incorrect usage of "Splunk":

Do this	Don't do this
Configure Splunk software.	Configure your Splunk.
Restart the Splunk platform.	Restart Splunk.
Run the Splunk universal forwarder.	Run Splunk's universal forwarder.
Run the Splunk platform on your data.	Splunk your data.
Access your Splunk platform instance.	Access your Splunk instance.

Splunk software

Use "Splunk software" to refer to anything and everything the company offers. Use this term only when you are referring to a Splunk platform product and an app, or when either a Splunk platform product or an app can be the subject. Otherwise, aim to choose the most specific term for your situation.

When using the term "Splunk software", follow these conventions:

• Don't capitalize the "s" in "software".
• Don't include a definite article.
• Don't use "Splunk software" in the possessive form, which can dilute the trademark. See Trademark attribution.

Review the following table for examples of correct usage:

Do this	Don't do this
Splunk software	Splunk Software The Splunk software
Splunk software processing properties	Splunk software's processing properties

The Splunk platform

Use "the Splunk platform" to refer to both Splunk Enterprise and Splunk Cloud Platform. You can use "the Splunk platform" either as a noun or as a modifier.

Before you use a general term like the Splunk platform, consider whether a specific component of the product, like the search head, the indexer cluster, Splunk Web, the data collection node, the deployment server, the forwarder, and so on, is more helpful for customers. See Splunk platform architecture components.

As a noun

When using "the Splunk platform" as a noun, follow these conventions:

• Include a definite article.
• Don't capitalize the "p" in "platform".
• Don't use "the Splunk platform" in the possessive form, which can dilute the trademark. See Trademark attributions.

Review the following table for examples of correct usage:

Do this	Don't do this
the Splunk platform	The Splunk Platform Splunk platform
the searching capabilities of the Splunk platform	the Splunk platform's searching capabilities

As a modifier

You can use "the Splunk platform" or "Splunk platform" without a definite article as a modifier. Avoid using "Splunk" as a modifier by itself when you are referring to a specific instance where the Splunk platform is installed, Splunk platform deployments, or the environment in which the Splunk platform is running.

Review the following table for examples of correct usage:

Do this	Don't do this
Restart the Splunk platform instance...	Restart the Splunk instance…
In a distributed Splunk platform deployment...	In a distributed Splunk deployment…
In your Splunk platform environment...	In your Splunk environment…

Splunk platform architecture components

Don't capitalize Splunk platform architecture components such as indexers, forwarders, search heads, license managers, and deployment servers. If you are unsure how to capitalize a Splunk term, see the Splexicon for the correct capitalization.

Splunk Observability

Splunk Observability is a cloud-only product category that includes Splunk Observability Cloud and Splunk AppDynamics, and is separate from the Splunk platform product offerings.

When referring to this product category, follow these conventions:

• Don't omit "Splunk" to shorten the name of the category.
• You can refer to "observability" as a general concept by using its lowercase form. Do not use the term "Full Stack Observability", the acronym FSO, or other variations of the term to refer to this product category.
• Don't use abbreviations.
• Don't use the definite article "the" in front of the product name as a noun.
• Don't refer to this category as a "platform".
• Don't use "Splunk Observability" in the possessive form, which can dilute the trademark. See Trademark attribution.

Review the following table for examples of correct usage:

Do this	Don't do this
Splunk Observability	FSO SO Observability Full Stack Observability the Splunk Observability the Splunk Observability platform
features of Splunk Observability	Splunk Observability's features

Using Splunk product abbreviations

Some Splunk products have approved abbreviations that you can use, such as Splunk IT Service Intelligence (ITSI) and Splunk Enterprise Security (ES). Refer to your product's specific style sheet to find what abbreviations are approved. Product abbreviations can be useful in the following situations:

• If you need to refer to the product name multiple times on a page
• If you have limited character space, such as in a table or in the UI

Do not use abbreviations if they aren't approved by Legal. For example, do not abbreviate terms like "Splunk Enterprise", "Splunk Cloud Platform", or "Splunk Observability Cloud".

Follow these guidelines for using abbreviations:

• For general guidelines, see Abbreviations.
• For UI text, see Product abbreviations in the UI text style guidelines.

If you're not sure about whether to use abbreviations, contact your legal liaison and the editing team.