E

A scheduled report that is embedded in an external web page or HTML-based dashboard. You can embed any scheduled report from the Reports listing page. Embedded reports always display the results of their last scheduled run and present the visualization type and formatting of the original report. The reports are read-only from the perspective of visitors to the external web page or dashboard in which they are embedded.

Related Products: Platform

Cloud-based data repositories with strict access controls to store structured or unstructured intelligence data in Threat Intelligence Management.

Related Products: Platform

Related Terms: intelligence workflow

Configuration file settings that are automatically enforced by the identity manager framework in Splunk Enterprise Security. You can turn on or turn off enforcements as needed.

Related Products: Platform, Enterprise Security

A Splunk Enterprise Support service level that provides direct access to the Customer Support Team and lets customers manage their cases online. You must have an Enterprise or Global support contract to upgrade a Splunk server with a license for Splunk Enterprise to a new major version of Splunk Enterprise. The following Splunk Enterprise resources are available to anyone for answers to basic technical questions:

Related Products: Platform

A logical grouping of entities, such as assets and identities , that share common characteristics. Use entity zones to organize and correlate entities across different zones. For example, if your company merges with another company, you can use entity zones to separate the IP address spaces of the two companies and track any suspicious activity that occurs within a particular zone.

Related Products: Platform

In Platform, a single piece of data in Splunk software, similar to a record in a log file or other data input. When data is indexed , it is divided into individual events. Each event is given a timestamp , host , source , and source type . Often, a single event corresponds to a single line in your inputs, but some inputs (for example, XML logs) have multiline events , and some inputs have multiple events on a single line. When you run a successful search, you get back events. Similar events can be categorized together with event types .

In AppDynamics, unstructured data that represents an action or occurrence detected by the agent. Examples include JVM restart, deadlock, and error. See also Monitor Events.

In Observability Cloud, an event is a periodic occurrence that can be represented as a structured log line to Splunk Infrastructure Monitoring. For example, the values could be represented as any combination of key/value pairs. Events are secondary to metrics in Infrastructure Monitoring and are meant to provide context for the metric data. Events can be displayed on charts and viewed in the Events sidebar....

Related Products: Platform, AppDynamics, Observability Cloud

A time series visualization that overlays a chart with event flags and labels that are pulled from a secondary search from logs, lookups , or a manually added data source. Event annotations can provide context for trends in a chart by displaying correlating events. Event annotations can be added to line charts, column charts, and area charts using Simple XML .

Related Products: Platform

A descriptive term for all the IT data that has been added to Splunk software indexes . The individual pieces of data are called events . Splunk software also stores information related to its own structure and processing. This includes everything that is not event data.

Related Products: Platform

A subset of events within a larger pool of event data returned by a search. Events that belong to an event pattern share common characteristics and usually can be returned by a specific search string. When you run a search that returns dataset with a diverse array of events, you can use event pattern analysis to see the most common kinds of events in that dataset. The Patterns tab shows you the event patterns in the results of a specific search.

Related Products: Platform

Event processing covers everything that happens to your data between the time you define an input and the time the data appears in the Splunk index. At index time , Splunk software organizes and structures your data, including processing multiline events , extracting important fields such as the timestamp , and compressing the data. The Splunk Web data preview tool is available in both Splunk Enterprise and Splunk Cloud Platform. Data preview lets you configure the format of your event data before processing. Use it to see how your processed events will look and make adjustments to improve the formatting of the data. In Splunk Enterprise, you can configure and customize event processing using configuration files . After the data is in the index, you can add additional knowledge to your events, such as fields , tags , and event types .

Related Products: Platform

A user-defined field that represents a category of events . These events are united by the fact that they can all be matched by the same search string. Splunk Enterprise applies event types to the events that match them at search time . When you run a search that returns a useful set of events, you can save that search as an event type. Later, when you use that event type in another search, you are saying that the search should use the dataset represented by that event type. Event types are a type of knowledge object .

Related Products: Platform

See Build Event Type utility

Related Products: Platform

The act of creating a search , report , dataset , or other knowledge object that is built upon a reference to another dataset. This reference means that the object always "looks back" to the original dataset for its foundational data. If the definition of the original dataset changes, those changes are passed down to any datasets that extend it as well. Dataset extension is not the same as dataset cloning. When you clone a dataset, you create a distinct, individual dataset that is identical to the original dataset but not otherwise connected to it. When you extend a dataset, you create a dataset, report, dashboard panel, or alert that is bound to the original dataset through its reference to that dataset.

Related Products: Platform

Data that originates outside of Splunk Enterprise, for example, external log data or network data. In discussions of indexer clusters , this term distinguishes such data from replicated data .

Related Products: Platform

A field that has been extracted from event data . See also field extraction .

Related Products: Platform