D

A user interface associated with an app . Dashboard Studio dashboards have one or more visualizations . Classic Simple XML dashboards have one or more visualization panels. You can build dashboards when saving a search or visualization. You can also create dashboards using the dashboard editor . Classic Simple XML dashboards use Simple XML source code while Dashboard Studio dashboards use JSON source code. Edit this source code or use the dashboard visual editor to customize a dashboard.

Related Products: Platform

An interactive editor available in both Dashboard Studio and Classic Simple XML dashboards to create and edit dashboards . The Dashboard Studio dashboard editor has a JSON source code editor, while the dashboard editor for Classic Simple XML dashboards has a Simple XML source code editor. Both dashboard editors also have a visual editor that you can use to create dashboards without coding. You can use the visual editor, the source code editor, or both editor options to build dashboards and change components.

Related Products: Platform

A data distribution configuration where a forwarder sends copies of any events to two or more receiving indexers . You can use data cloning in conjunction with load balancing and data routing .

Related Products: Platform

A method for controlling the data sent between forwarding and receiving instances of Splunk Enterprise. A data distribution configuration is chosen to meet architectural, data redundancy, and other data path and storage requirements defined during implementation. Advanced configurations can involve data cloning , data routing , and data filtering .

Related Products: Platform

A data model is a type of knowledge object that applies an information structure to raw data, making it easier to use. Each data model represents a category of event data. Data models are composed of data model datasets .

Related Products: Platform

A data-summary-backed method of accelerating the datasets within data models , causing pivot searches on that dataset to run much faster than they would otherwise. The collection of summaries that a data model uses for acceleration is called the high performance analytics store . There are two types of data model acceleration:

Related Products: Platform

The building block of a data model . Each data model is composed of one or more data model datasets. Each dataset within a data model defines a subset of the dataset represented by the data model as a whole. Data model datasets have a hierarchical relationship with each other, meaning they have parent-child relationships. Data models can contain multiple dataset hierarchies. There are three types of dataset hierarchies: event, search, and transaction. Data model datasets are listed on the Datasets listing page along with CSV lookup files, CSV lookup definitions, and table datasets. Prior to Splunk Enterprise 6.5.0, data model datasets were referred to as data model objects.

Related Products: Platform

A Splunk Web tool that enables the design and maintenance of data models and their dataset collections.

Related Products: Platform

A software component that parses and routes SPL2 modules to splunkd .

Related Products: Platform

The route that data takes through Splunk Enterprise, from its origin in sources such as log files and network feeds, to its transformation into searchable events that encapsulate valuable knowledge. The data pipeline includes these segments: You can assign each of these segments to a different Splunk Enterprise instance or component .

Related Products: Platform

A method of data distribution where one Splunk Enterprise instance routes and forwards data to one or more receiving Splunk Enterprise instances based on the data content. For example, in a situation where one forwarder routes data to two indexers , the forwarder matches conditions based on patterns in the data to selectively send some data to one of the receivers and the rest of the data to the other receiver. You can use data routing to send event data to specific queues, indexes, or third-party systems. You can also use data routing in conjunction with cloning and load balancing .

Related Products: Platform

See series .

Related Products: Platform

A dataset is a collection of data. Some datasets you define and maintain for a specific business purpose. Other datasets are generated from ingesting or uploading data. Examples of datasets include indexes, lookups, data models, and table datasets. With SPL2, additional kinds of datasets include views and dataset literals. A dataset literal consists of an array of objects. You can view and manage datasets with the Datasets listing page. You can use datasets as the basis for visualization-rich Pivot reports and extend datasets in Search. The Splunk Datasets Add-on, available from Splunkbase, gives Splunk Enterprise users additional dataset management capabilities. Splunk Cloud Platform users have the Splunk Datasets Add-on by default.

Related Products: Platform

A type of search command that requires the entire dataset to be gathered in one place before the command can run. Dataset processing commands are not transforming, not distributable, not streaming, and not orchestrating. Dataset processing commands include eventstats , outlier , reverse , and sort . Some commands become dataset processing commands in specific situations or when specific arguments are used. These include bin , dedup , filllnull , from , transaction , and union .

Related Products: Platform

The process of bucket fixing that an indexer cluster undertakes when a peer node goes offline permanently. This operation continues until the cluster returns to a valid and complete state.

Related Products: Platform

An indexed field that Splunk Enterprise recognizes in your event data at search time . Three important default fields are host , source , and source type , which describe where the event originated. Other default fields include date/time fields, which provide additional searchable granularity to event timestamps . Splunk Enterprise also adds default fields classified as internal fields .

Related Products: Platform

A target group to which a forwarder routes event data when the data does not fit into other defined target groups. For example, you can arrange to route all events with the word "error" in them into one target group, route all events with a sourcetype of syslog to a second target group, and route all remaining events to a default group.

Related Products: Platform

A filtering rule that excludes one or more members from a set. For example, you can use deny list rules to tell a forwarder which files not to consume when monitoring directories, or you can use a deny list rule with the deployment server to filter out a certain deployment client . You can combine deny list rules with allow list rules, which tell the Splunk platform which members of a set to allow in order to achieve precise filtering. Deny list rules override allow list rules. The term "deny list" replaces the term "blacklist", which is no longer in use. Both terms refer to the same functionality.

Related Products: Platform

A Splunk Enterprise instance that distributes baseline configurations and apps to search head cluster members . Note: The deployer is not a search head cluster member.

Related Products: Platform

Related Terms: search head cluster member, deployment server

A set of distributed Splunk Enterprise instances, working together. A typical deployment scenario consists of a number of forwarders and one or more indexers , with the forwarders sending data to the indexers to index and search. Distributed search is another type of Splunk Enterprise deployment. A single deployment scenario might combine both forwarding and distributed search. Splunk Enterprise simplifies the management of deployments with its deployment server technology, in which a Splunk Enterprise instance (the deployment server ) distributes content and configuration files to a large number of deployed instances (the deployment clients ).

Related Products: Platform

A unit of content deployed by the deployment server to a group of deployment clients . Deployment apps can be fully developed apps , such as those available in Splunkbase , or they can be simple groups of configurations.

Related Products: Platform

A Splunk Enterprise instance that is remotely configured by a deployment server . Deployment clients can be grouped together into one or more server classes . Each deployment client periodically polls its deployment server. If the deployment server has new content for the client's server class, it distributes that content to the polling client.

Related Products: Platform

A Splunk Enterprise instance that acts as a centralized configuration manager, grouping together and collectively managing any number of Splunk Enterprise instances. Instances that are remotely configured by deployment servers are called deployment clients . The deployment server downloads updated content, such as configuration files and apps, to deployment clients. Units of such content are known as deployment apps . The forwarder management interface offers an easy way to configure the deployment server.

Related Products: Platform

Security content from the Splunk Threat Research Team that helps analysts understand and respond to entity-generated anomalies by mapping the anomalies to threat detection playbooks and priorities.

Related Products: Platform

In Platform, a field that indicates how a metric can be split to compare the metric across different entities. For example, the "dc" dimension indicates a data center location and might include values such as "east1", "east2","west1", and "central1".

In Observability Cloud, a dimension is a key/value pair that, along with the metric name, is part of the identity of a time series. You can filter and aggregate time series by those dimensions across Infrastructure Monitoring.

Related Products: Platform, Observability Cloud

A label that indicates the threat level of a notable event , such as an undetermined or false positive threat. You can use dispositions to classify notable events and separate false positives from true and benign positives without impacting the notable event's status.

Related Products: Platform

See Monitoring console .

Related Products: Platform

A deployment topology that portions search management and search fulfillment/indexing activities across multiple Splunk Enterprise instances. In distributed search, a Splunk Enterprise instance, referred to as the search head , distributes search requests to other instances, called search peers , which perform the actual searching, as well as the data indexing. The search head merges the results back to the user. Distributed search provides horizontal scaling, so that a single Splunk Enterprise deployment can search and index arbitrarily large amounts of data. Distributed search is also useful for correlating data across data silos.

Related Products: Platform

Related Terms: search head cluster

In open source software, a distribution is a curated collection of software components that's ready to use for a specific purpose. For example, Linux distributions take the upstream Linux kernel and package it with other software to create an operating system that users can install on their machines. The Splunk Distribution of OpenTelemetry Collector is a distribution of the OpenTelemetry Collector, an upstream project. It includes components and settings that support the use of the Collector with Splunk software, such as telemetry exporters and Splunk software-specific settings.

Related Products: Platform

Related Terms: upstream

Interactive functionality that retrieves and displays additional details when you click specific visualization or search result elements. When you select a table row, cell, or other element, a new search opens on the data in that element. You can enable or disable visualization drilldown. Default behavior and configuration options vary by visualization.

Related Products: Platform

A search head cluster captain that is elected by the cluster members. A dynamic captain can change over time. This is the default type of search head cluster captain.

Related Products: Platform

Related Terms: static captain