L

A component of the Splunk index that maps the values that appear in events to their location in an index. When you search for a term, the index's lexicon identifies the location of events in the rawdata journal that might contain that term.

Related Products: Platform

A file that contains information about the amount of data your Splunk software installation or Splunk Cloud Platform environment is entitled to index in a single day. This amount is sometimes referred to as the license entitlement. In Splunk Enterprise, an entitlement can include multiple licenses distributed across a larger deployment of Splunk Enterprise instances. Splunk Enterprise licenses are available in two types: Enterprise and Free. Splunk Light and Hunk manage license entitlement differently from Splunk Enterprise, but the concepts are the same.

Related Products: Platform

A set of license stacks . A stack can be a member of only one license group, and only one license group can be "active" in your Splunk Enterprise installation at any given time. This means that a given license master can administer licenses of only one group type at a time. The available license group types include enterprise trial/sales, enterprise trial, free, and forwarder.

Related Products: Platform

A central license repository for Splunk Enterprise licenses. From the license manager, you can define license stacks and pools , add licensing capacity, and configure the license volume allocated to license peers . The term "license manager" replaces the term "license master", which is no longer in use. Both terms refer to the same repository and functionality.

Related Products: Platform

See License manager .

Related Products: Platform

A Splunk Enterprise instance that communicates with a central license manager to obtain access to Splunk Enterprise features. A license peer that indexes data also receives an allocated license volume. The term "license peer" replaces the term "license slave", which is no longer in use. Both terms refer to the same instance type and functionality.

Related Products: Platform

A quantity of licensing volume allocated from a stack . The license master manages pools and assigns license slaves to each pool, so that the slaves have access to licensing volume.

Related Products: Platform

A Splunk Enterprise instance that communicates with a central license manager to obtain access to Splunk Enterprise features. A license peer that indexes data also receives an allocated license volume. The term "license peer" replaces the term "license slave", which is no longer in use. Both terms refer to the same instance type and functionality.

Related Products: Platform

noun, verb A collection of licenses whose individual licensing volume amounts aggregate to serve as a single unified amount of indexing volume. When you aggregate license volumes into a single amount, you are "stacking the licenses." You can create a license pool from a license stack. You can stack only Enterprise licenses and Enterprise Sales Trial licenses. You cannot stack Enterprise Trial licenses and Splunk Free licenses.

Related Products: Platform

A version of a forwarder , a Splunk Enterprise instance that forwards data to another Splunk Enterprise instance or to a third-party system. A light forwarder has less of an impact on system resources because it does not have as much functionality as a heavy forwarder . You can configure a Splunk Enterprise instance as a light forwarder through the CLI or through Splunk Web. The light forwarder has been deprecated in Splunk Enterprise version 6.0.

Related Products: Platform

Related Terms: universal forwarder

The activity by which a forwarder distributes its data stream across multiple receiving indexers in a predefined group. For example, if you define a load-balanced group of three receiving indexers, the forwarder switches from one indexer to another after a specified interval so that each indexer receives a portion of the data.

Related Products: Platform

Related Terms: weighted load balancing

A level, usually configurable, describing the type and/or quantity of output that an application writes to a log file. Set the logging verbosity of an application to specify how much and what kind of information the application writes to its log file. The Splunk Enterprise logging verbosity levels are DEBUG, INFO, NOTICE, WARN, ERROR, CRIT, ALERT, FATAL, and EMERG. These are in order of most to least verbose.

Related Products: Platform

A knowledge object that provides data enrichment by mapping a select value in an event to a field in another data source, and appending the matched results to the original event. For example, you can use a lookup to match an HTTP status code and return a new field containing a detailed description of the status. The data sources for lookup content include search results, .csv files, geospatial .kmz files, KVStore collections, and script-facilitated external database connections. CSV lookup files and CSV lookup definitions are also dataset types. The Datasets listing page lists them alongside data model datasets and table datasets . Lookups are incorporated into dashboards and forms to provide content in a human readable format, allowing users to interact with event data without knowing obscure or cryptic event fields.

Related Products: Platform

The part of a lookup configuration that defines the data type and connection parameters used when comparing event fields. Splunk Enterprise lookup definitions can connect to lookup tables in .csv files, .kmz files, external data sources, and KVStore collections.

Related Products: Platform