C

The part of an indexer that manages the SmartStore cache. The goal of the cache manager is to optimize the use of local storage. The cache manager handles the transfer of bucket copies between local and remote storage. It also evicts bucket copies from local storage.

Related Products: Platform

A field that represents the output of an eval expression. Splunk search defines and adds calculated fields to events at search-time, and it processes calculated fields after it processes search-time field extractions. This means that the eval expression at the heart of the calculated field definition can use values from one or more previously extracted fields. Splunk search evaluates each calculated field independently of other calculated fields. You cannot chain them together by using one calculated field in the eval expression for another calculated field.

Related Products: Platform

A user action within the Splunk platform. You can use role-based security to restrict user actions in the software. For example, you can allow users to list data inputs but not to edit them. The Splunk platform associates capabilities with specific roles . The authorize.conf configuration file provides a list of the user actions that you can use to configure roles.

Related Products: Platform

See search head cluster captain or KV store captain .

Related Products: Platform

A method for displaying and working with language characters on computer systems. In Splunk Enterprise, all IT data sources default to UTF-8 encoding. A different character set can be assigned through the CHARSET key in the props.conf configuration file.

Related Products: Platform

See indexer cluster or search head cluster .

Related Products: Platform

See index replication or search head clustering .

Related Products: Platform

The container for a set of data in an App Key Value Store , similar to a database table where each record has a unique key. Collections exist within the context of a given app.

Related Products: Platform

Related Terms: kv store captain

The Splunk Enterprise command-line interface (CLI) is a text interface that you use to enter system commands, edit configuration files , and run searches. Splunk Enterprise also provides command-line tools that help you to troubleshoot deployment and configuration issues.

Related Products: Platform

A Splunk utility that can be run from the command-line interface (CLI) to troubleshoot a Splunk Enterprise deployment. Examples of command-line tools include btool, locktool, and signtool. Do not use command-line tools without assistance from a member of the Splunk Support team.

Related Products: Platform

A set of preconfigured data models that you can apply to your data at search time. Each data model in the CIM consists of a set of field names and tags that define the least common denominator of a domain of interest. The CIM lets you normalize your data to match a common standard, using the same field names and event tags for equivalent events from different sources or vendors.

Related Products: Platform

The indexer cluster state in which the cluster has both: In the case of a multisite indexer cluster , the number of bucket copies must also fulfill the site-specific requirements for the replication and search factors. A complete cluster meets the designated requirements for disaster tolerance. A complete cluster is also a valid cluster.

Related Products: Platform

One of several types of Splunk Enterprise instances . Each component handles one or more Splunk Enterprise roles, such as data input or indexing. There are several types of Splunk Enterprise components. They fall into two broad categories: In a distributed environment, you typically allocate the segments of the data pipeline to different processing components. These are the available processing component types: Management components include:

Related Products: Platform

A data routing scenario where a forwarder selectively sends event data to receivers based on patterns in the event data.

Related Products: Platform

See configuration file .

Related Products: Platform

In an indexer cluster , the set of common configuration files and apps that the master node distributes to the peer nodes . In a search head cluster , the set of common configuration files and apps that the deployer distributes to the cluster members .

Related Products: Platform

Related Terms: indexer cluster, master node (no longer in use), search head cluster, deployer, deployment server

A file that contains Splunk Enterprise and Splunk Cloud Platform settings and configuration information. Also referred to as a .conf file, configuration files are stored in the following locations: To configure Splunk Enterprise, you can modify configuration settings by editing stanzas within copies of the default configuration files in a local directory. To configure Splunk Cloud Platform, you must use Splunk Web since Splunk Cloud Platform users do not have access to the file system of the Splunk Cloud Platform deployment and cannot manually edit .conf files.

Related Products: Platform

An entity that permits connection from Splunk Mission Control to an external device, such as Okta or Maxmind. Comparable to an app in Splunk SOAR (Cloud), a connector determines the actions available to a user or to a playbook for that specific device.

Related Products: Platform

A fundamental component of a data model dataset . Constraints filter out irrelevant events and narrow down the dataset that the dataset represents. Constraint definitions differ according to the object type. They can be simple searches (root event datasets, all child datasets), complex searches (root search datasets), or transaction definitions (root transaction datasets). Each child object inherits the constraints of its parent object and includes a new constraint that ensures it represents a subset of the data covered by its parent dataset.

Related Products: Platform

An event that contributes to the creation of an incident in Splunk Mission Control or a notable event in Splunk Enterprise Security.

Related Products: Platform, Enterprise Security

A correlation search is a type of scheduled search . It lets you detect suspicious events and patterns in your data. You can configure a correlation search to generate a notable event when search results meet specific conditions. The correlation search results must include at least one event to generate a notable. You can investigate notable events using the Incident Review dashboard in Splunk Enterprise Security and the Splunk App for PCI Compliance, or the Notable Events Review dashboard in Splunk IT Service Intelligence.

Related Products: Platform, Enterprise Security

In Platform, a type of metric that has a value that always increases when it changes, except when it is reset to zero. Automobile odometers are a simple counter metric example. Odometers indicate the number of miles that a car has been driven. Odometer values never go down, except when they are reset to zero. There are two types of counter metrics: periodic and accumulating. Periodic counter metrics are reset to zero each time the client sends a measurement to the server. This means that each data point for a periodic counter metric is independent of the other data points belonging to that metric. Accumulating counter metrics are only reset to zero when the service is reset. Each new value is added to the last one. You can compare two measurements to get the rate of value accumulation.

In Observability Cloud, the counter metric type represents data that is a count of occurrences in a time interval. It measures occurrences of an activity or event, for example, the number of web pages served by a website or the number of exceptions in a process. Summing counters over a period of time produces the net activity in that interval. Counters can only take integer...

Related Products: Platform, Observability Cloud