H

A type of forwarder , which is a Splunk Enterprise instance that sends data to another Splunk Enterprise instance or to a third-party system. A heavy forwarder has a smaller footprint than a Splunk Enterprise indexer but retains most of the capabilities of an indexer. An exception is that it cannot perform distributed searches. You can disable some services, such as Splunk Web, to further reduce its footprint size. Unlike other forwarder types, a heavy forwarder parses data before forwarding it and can route data based on criteria such as source or type of event. It can also index data locally while forwarding the data to another indexer. In most situations, the universal forwarder is the best way to forward data to indexers. Its main limitation is that it forwards only unparsed data, except in certain cases, such as structured data . You must use a heavy forwarder to route data based on event contents.

Related Products: Platform

Related Terms: universal forwarder, light forwarder

The collection of .tsidx file summaries used to accelerate one or more data models through persistent data model acceleration .

Related Products: Platform

A search that has a distinct time range, such as the past hour, the previous day, or "between 2 and 4 last Tuesday". Historical searches usually review data in the past, but you can set up these searches to review events with future-dated timestamps, if your index contains them. This term differentiates historical searches from real-time searches , which run over a window of time until they are stopped and which search incoming events as they are processed for indexing.

Related Products: Platform

A default field that contains the host name or IP address of the network device that generated an event . Each event has a host field. The indexer generates the host field at index time. You use the host field in searches to narrow the search results to events that originate from a specific device. You can configure host values for events when events are input into Splunk Enterprise. You can set a default host for a Splunk Enterprise server, file, or directory input. You can also have Splunk Enterprise assign host values to events based on data in those events.

Related Products: Platform

A search that combines data from on-premises Splunk Enterprise indexers and Splunk Cloud Platform. You must run a hybrid search from an on-premises search head.

Related Products: Platform