parsing

parsing

noun

The second segment of the data pipeline. Data arrives at this segment from the input segment. This segment is where event processing occurs (where Splunk Enterprise analyzes data into logical components).

After data is parsed, it moves to the next segment of the pipeline, indexing.

Parsing of external data can occur on either an indexer or a heavy forwarder.

Parsing can also occur on other components under limited circumstances:

• Various components, such as search heads and indexer cluster master nodes, process their own internal data. When doing so, they perform parsing locally.
• When a universal forwarder ingests structured data, it performs the parsing locally. The indexer does not further parse the structured data.

For more information

In the Distributed Deployment Manual:

• How data moves through Splunk Enterprise: the data pipeline

In Getting Data In:

• Extract fields from files with structured data