L

An index you create on a federated search head for the purpose of running federated searches . Each federated index maps to a specific remote dataset on a federated provider . In Federated Search for Splunk, federated indexes can map to indexes , saved searches , and data models . Federated indexes for Federated Search for Amazon S3 map to AWS Glue Data Catalog tables. Federated indexes can't be targets for data inputs. When you write a federated search you invoke federated indexes by name to indicate that you wish to search the datasets to which the indexes map. Federated indexes are governed by federated index definitions, which you create and manage in Splunk Web.

Related Products: Platform

A remote source of data that you search with federated searches . Federated providers can be Splunk Enterprise deployments, Splunk Cloud Platform environments, or Amazon S3 buckets. A single federated search can reference multiple federated providers. The link between a Splunk platform deployment and a federated provider is governed by a federated provider definition, which you create and manage in Splunk Web, and store on the Splunk platform deployment from which the federated search is run.

Related Products: Platform

A search from a Splunk platform deployment that returns data from one or more remote federated providers . This data can be combined with data from the Splunk platform deployment that runs the federated search. Federated search is an improvement upon hybrid search , which enables searches that combine data from a Splunk Enterprise deployment and only one Splunk Cloud Platform environment.

Related Products: Platform

A search head residing on a local Splunk platform deployment that initiates federated searches . Contains federated indexes . In this case, "local" means "the deployment from which you are initiating a federated search", as opposed to the remote federated providers that you search with federated searches.

Related Products: Platform

A searchable name/value pair in Splunk Enterprise event data . Splunk Enterprise extracts specific default fields from your data, including host , source , and sourcetype . You can also set up Splunk Enterprise to create search time or index time field extractions , for example, using the field extractor or the rex command. Use tags or aliases to change the name of a field or to group similar fields together. Field names are case-sensitive.

Related Products: Platform

See alias .

Related Products: Platform

The process by which Splunk Enterprise extracts key=value pairs from event data at search time . When field discovery is enabled, Splunk Enterprise: You can disable field discovery to improve search performance. To disable field discovery, change your search mode to Fast.

Related Products: Platform

Both the process by which Splunk Enterprise extracts fields from event data and the results of that process, are referred to as extracted fields . Splunk Enterprise extracts a set of default fields for each event it indexes. Field extraction can take place either before event indexing (in the case of default fields and indexed fields ) or after event indexing (in the case of search fields ). You can also create custom fields by defining additional index-time and search-time field extractions, using search commands, the field extractor , or configuration files .

Related Products: Platform

A Splunk Enterprise utility that helps you to dynamically create custom fields . First, you highlight portions of a sample event that should be extracted as fields. Then the field extractor generates a regular expression that extracts those fields from similar events. You can validate the extraction results and improve extraction accuracy by removing false-positive matches. The field extractor can build only search-time field extractions that are associated with specific source types .

Related Products: Platform

A data input that tracks changes to your file system. It monitors any directory that you specify and generates an event in Splunk Enterprise when that directory undergoes any change. Note: The file system change monitor has been deprecated in Splunk Enterprise since version 5.0.

Related Products: Platform

The action of limiting a set of events , or fields within events, by applying criteria to them. Certain configuration files , such as inputs.conf and serverclass.conf , provide attributes that you can use to define inclusion and exclusion filtering rules.

Related Products: Platform

An action you can perform on running search jobs . This action stops the search before it finishes and gets the results that have been retrieved up to that point. You can use the finalized results to build a report, but the report might not be accurate for the time range you selected.

Related Products: Platform

A subdirectory where Splunk software tracks how far into a file indexing has progressed, to enable the software to detect when data has been added to the file and resume indexing. The fishbucket subdirectory contains seek pointers and CRCs for indexed files.

Related Products: Platform

A form is a dashboard that provides user inputs to the search that drives the data that appears in the form. User inputs include components such as a drop-down list, radio buttons, or a text box. You can create and edit a form with the Dashboard Editor . To create a form, create a dashboard and then add a user input component. A form has all the properties and behavior of a dashboard.

Related Products: Platform

A Splunk Enterprise instance that forwards data to another Splunk Enterprise instance, such as an indexer or another forwarder, or to a third-party system. There are three types of forwarders: The universal forwarder is the best tool for forwarding data to indexers. Its main limitation is that it forwards only unparsed data. To send event-based data to indexers, you must use a heavy forwarder.

Related Products: Platform

A graphical interface built on top of the deployment server that provides an easy way to configure the deployment server and monitor the status of deployment updates.

Related Products: Platform

The act of sending parsed or unparsed data from one instance of Splunk Enterprise to another. The host that originates the data is the forwarder , and the host that receives the data is the receiver .

Related Products: Platform

Related Terms: deployment

License for a forwarder , which is a Splunk Enterprise instance that forwards data to another Splunk Enterprise server or to a third-party system. Splunk Enterprise offers several forwarder licensing options: Forwarder licenses are included with Splunk Enterprise. If you install a universal forwarder, the license is preinstalled.

Related Products: Platform

See file system change monitor .

Related Products: Platform