The system process that handles indexing, searching, forwarding, and (as of Splunk Enterprise version 6.2) the Web interface that you log into Splunk Enterprise with.

The process is a distributed C/C++ binary that accesses, processes, and indexes streaming data and handles search requests. It also handles the Splunk Web interface as of Splunk Enterprise version 6.2. You can configure the splunkd service without the Splunk Web component by configuring the instance as a light or heavy forwarder.

Universal forwarders also run splunkd, but those instances cannot provide Splunk Web and can forward only unparsed data.

For more information

In the Installation Manual:

In the Admin Manual: