I

A user in the customer network. Splunk Enterprise Security uses machine data generated by identities to contextualize users and associate them with events to identify potential security threats.

Related Products: Platform, Enterprise Security

Related Terms: asset, risk object

An event generated by a correlation search as a security alert in Splunk Mission Control. Comparable to a notable event in Splunk Enterprise Security (Cloud), an incident is an item that you can investigate. As an example, it might include an email from a phishing inbox.

Related Products: Platform, Enterprise Security

Related Terms: event, artifact, response plan

A category of incidents that share common characteristics, such as source or severity. After creating an incident type in Splunk Mission Control, you can associate the incident type with a response template to automate and personalize your incident response workflow.

Related Products: Platform

The repository for data. When the Splunk platform indexes raw data, it transforms the data into searchable events . Indexes reside in flat files on the indexer . There are two types of indexes: In general, the act of processing raw data and adding the processed data to an index. Specifically, indexing is the third segment of the data pipeline , in which the indexer takes parsed events and writes them to the search index on disk.

Related Products: Platform

The files in an index bucket that contain the metadata that the indexer uses to search the bucket's event data . The main index files are the tsidx files , but the bucket contains a number of other metadata files as well. The event data itself is contained in the rawdata file . The rawdata file and the index files together constitute the files in a bucket. In an indexer cluster , a searchable copy of a bucket contains both index files and a rawdata file. A non-searchable copy contains only the rawdata file.

Related Products: Platform

A configurable feature that allows an indexer to use multiple pipeline sets .

Related Products: Platform

A Splunk Enterprise feature that consists of clusters of indexers that are configured to replicate data to achieve several goals: data availability, data fidelity, disaster tolerance, and improved search performance. Index replication is sometimes referred to as "indexer clustering."

Related Products: Platform

Related Terms: search head clustering

The time span from when Splunk Enterprise receives new data to when the data is written to a Splunk Enterprise index . During that time, the data is parsed into segments and events ; default fields and timestamps are extracted; and transforms are applied. In the context of Splunk Observability Cloud, use index-time rules to transform your data, or a designated subset of your data, during ingestion into Splunk Observability Cloud.

Related Products: Platform

A field that is incorporated into the index at index time . Indexed fields include the default fields , such as host , source , and sourcetype , as well as custom index-time field extractions . In rare cases, there is some value to adding fields to the index. However, this can negatively affect indexing performance and search times across your entire deployment . There is no way to modify or remove field extractions afterwards. You can add non-indexed fields, which are extracted at search time.

Related Products: Platform

A real-time search that runs after events are indexed within the sliding time range window that you define for the search. indexed real-time searches can substantially improve indexing performance. This is especially true if you're running a lot of concurrent real-time searches because indexed real-time searches decrease the impact on the indexer. An indexed real-time search is like a historical search, with the added benefit that it continually updates the search with new events as the events appear on disk. Indexed real-time search is disabled by default on Splunk Enterprise.

Related Products: Platform

Related Terms: search

A Splunk Enterprise instance that indexes data, transforming raw data into events and placing the results into an index . It also searches the indexed data in response to search requests. The indexer also frequently performs the other fundamental Splunk Enterprise functions: data input and search management . In larger deployments , forwarders handle data input and forward the data to the indexer for indexing. Similarly, although indexers always perform searches across their own data, in larger deployments, a specialized Splunk Enterprise instance, called a search head , handles search management and coordinates searches across multiple indexers. The indexer is sometimes referred to by more specific terms, according to its context.

Related Products: Platform

Related Terms: bucket

An optional capability on forwarders that helps prevent loss of data when sending data to an indexer . With indexer acknowledgment, the forwarder resends any data not acknowledged as "received" by the indexer. When forwarding data to a indexer cluster node, indexer acknowledgement helps ensure end-to-end data fidelity.

Related Products: Platform

A specially configured group of Splunk Enterprise indexers that replicate external data , so that they maintain multiple copies of the data. Indexer clusters promote high availability and disaster recovery.

Related Products: Platform

Related Terms: index replication, indexer cluster node, search head cluster

One of the Splunk Enterprise instances that constitute an indexer cluster . Each indexer cluster has these types of nodes: one manager node , one or more peer nodes , and one or more search heads .

Related Products: Platform

See index replication .

Related Products: Platform

A capability of indexer clusters that enables forwarders to connect dynamically to the full set of available peer nodes .

Related Products: Platform

Related Terms: weighted load balancing

A queue in the data pipeline that holds events that have been parsed and need to be indexed. Incoming data first goes into the parsingQueue . From there, it goes into the parsing pipeline, where it undergoes event processing . It then moves into the indexQueue and on to the indexing pipeline, where the Splunk software stores the events on disk. Both parsing and indexing usually take place on the indexer . However, you can separate out the parsing stage, so that it occurs instead on a heavy forwarder .

Related Products: Platform

A piece of data that provides additional information about unusual, suspicious, or malicious cyber activity, such as when it was observed and the level of risk it poses. In Splunk Mission Control, observables become indicators after Threat Intelligence Management enriches and scores them for deeper context.

Related Products: Platform

Related Terms: notable event, incident, artifact, key indicators

A type of extraction that allows you to use one regular expression to extract multiple fields or create a new field by configuring an extraction. You can find information about when to use inline field extractions in the Configure custom fields at search time topic.

Related Products: Platform

Related Terms: automatic key value field extraction, transform field extraction

The first segment of the data pipeline , in which Splunk Enterprise acquires the raw data stream from its source, breaks it into 64K blocks, and annotates each block with metadata keys. After data has been acquired and split into blocks, it moves to the next segment of the pipeline, parsing . Data input can occur on either an indexer or a forwarder .

Related Products: Platform

The Inputs Data Manager (IDM) is a hosted solution for Splunk Cloud Platform for scripted inputs and modular inputs . In most cases, an IDM removes the need for customer-managed infrastructure. Customers on the Splunk Cloud Platform Victoria Experience don't need to use an IDM.

Related Products: Platform

A single running installation of Splunk Enterprise. In single-instance deployments, a single instance of Splunk Enterprise handles all data processing functions, including data input , indexing , and search management . In distributed deployments, processes are distributed across multiple Splunk Enterprise instances running on multiple machines. Each instance performs a specialized role, such as data input, indexing, search management, or various housekeeping functions. Specialized Splunk Enterprise instances are called components .

Related Products: Platform

A method that enables software applications to collect telemetry that represents how their code works. You can use instrumentation to send telemetry to an observability solution, such as Splunk Observability Cloud. There are two main ways of instrumenting software applications: Splunk Observability Cloud supports both automatic and manual instrumentation using the Splunk distribution of OpenTelemetry SDKs.

Related Products: Platform

Related Terms: agent

No-code data pipelines in Threat Intelligence Management that automate the extraction, transformation, prioritization, and sharing of indicators to meet specific security use case requirements. You can configure multiple intelligence workflows to pinpoint responses and reduce data wrangling, accelerate intelligence automation, and reduce false positives.

Related Products: Platform

Related Terms: enclaves, observable

An abstraction layer in Splunk software. Intentions enable the client user interface to update any search string with a common subset of search language modifications, without storing any language-parsing code on the client. Modules in the Splunk Enterprise UI pass intentions down the module tree hierarchy. The modules can modify the searches by adding intentions as they pass the search down the tree. After a series of intentions reaches a dispatching module, it composes the intentions into a search and then runs the search. In Developing Views and Apps for Splunk Web :

Related Products: Platform

A forwarder that you have configured to receive data from one or more forwarders and subsequently send that data to either an indexer or another forwarder. Setting up an intermediate forwarder is useful when: All forwarder types can act as intermediate forwarders.

Related Products: Platform

An indexer that is used for search processing in a parallel reduce search process. During a parallel reduce search, a subset of the indexers in a Splunk Enterprise deployment process a portion of a search before they push their results to the search head , where final processing and result aggregation takes place. This parallelization of work that otherwise would be done entirely on the search head can result in faster completion times for searches over large high-cardinality datasets. By default, when you initiate a parallel reduce search job, the Splunk platform randomly selects the subset of indexers that process the search as intermediate reducers. Alternatively, you can designate a set of indexers to be dedicated intermediate reducers. That set of indexers will always serve as intermediate reducers when you run parallel reduce search jobs.

Related Products: Platform

A default field that contains general information about the events that Splunk Enterprise has indexed. Internal fields are indicated by a leading underscore in their field name. For example: _raw is an internal field that contains the original raw data of the event, while the value of _time is the event's timestamp expressed in Unix time.

Related Products: Platform

A collaborative process of identifying, collecting, and examining notable events from Splunk Enterprise Security, or incidents from Splunk Mission Control, to detect and triage security threats.

Related Products: Platform, Enterprise Security

Related Terms: report

A way to track the progress of an investigation in Splunk Enterprise Security. You can create new statuses, restrict transitions between statuses, and set default statuses for new investigations.

Related Products: Platform, Enterprise Security

See event data .

Related Products: Platform