M

A character that is used to divide words, phrases, or terms in event data into large tokens. Examples of major breakers are spaces, commas, semicolons, question marks, parentheses, exclamation points, and quotation marks.

Related Products: Platform

Related Terms: minor breaker

The indexer cluster node that regulates the functioning of an indexer cluster . The term "manager node" replaces the term "master node", which is no longer in use. Both terms refer to the same node type and functionality.

Related Products: Platform

Related Terms: peer node

The indexer cluster node that regulates the functioning of an indexer cluster . The term "manager node" replaces the term "master node", which is no longer in use. Both terms refer to the same node type and functionality.

Related Products: Platform

Related Terms: peer node

A metric event that contains: For example, CPU usage metrics might include measurements for memory.used, memory.free, network.bytes.in, and network.bytes out.

Related Products: Platform

In Platform, a set of measurements , whose values can be aggregated or displayed as a time series.

In AppDynamics, numerical measurement over a time interval, typically with a fixed frequency. Because of this, metrics are represented through time-series visualization. Examples include "calls per minute" and "average response time." For Splunk AppDynamics, a metric is a numerical value that an agent measures and reports. See also Metric Browser.

In Observability Cloud, metrics are the primary form of data you send into Splunk Infrastructure Monitoring. A metric is a periodic measurement that is represented as a numerical value. The same metric can be reported from multiple sources or emitters. Typically, each unique combination of a source and a metric results in a metric time series.

Related Products: Platform, AppDynamics, Observability Cloud

A metric event with a unique timestamp. A metric data point must contain at least one numeric measurement for a metric . It can contain multiple metric measurements. Metric data points can also have additional dimensions that describe the metric measurements in the data point, but dimensions are not required.

Related Products: Platform

In Platform, a set of metric data points that all measure the same metrics and share the same dimension field-value pairs. For example, the following three metric data points form a metric time series. They offer measurements for the same metrics and have the same dimension field-value pairs. _time=08-05-2019 16:26:42.025 -0700, metric_name:max.size.kb=500, metric_name:current.size.kb=300, group=queue, name=azd _time=08-05-2019 16:26:41.055 -0700, metric_name:max.size.kb=345, metric_name:current.size.kb=245, group=queue, name=azd _time=08-05-2019 16:26:40.023 -0700, metric_name:max.size.kb=334, metric_name:current.size.kb=124, group=queue, name=azd Meanwhile the following metric data point would not be part of that time series because it has a different value for the name dimension. _time=08-05-2019 16:26:44.013 -0700, metric_name:max.size.kb=421, metric_name:current.size.kb=273, group=queue, name=nzt You can group metric data points by time series for the purpose of aggregating functions across those time series, such as averages, sums, or rates (in the case of counter metrics ).

In Observability Cloud, a metric time series (MTS) is defined by the unique combination of a metric and a set of dimensions (which may be empty). The most common dimension is a source, like a host or instance for infrastructure metrics, or an application component or service tier for application metrics. The output of analytics pipelines are also metric time series.

Related Products: Platform, Observability Cloud

A character that is used with major breakers to further divide large tokens of event data into smaller tokens. Examples of minor breakers are periods, forward slashes, colons, dollar signs, pound signs, underscores, and percent signs.

Related Products: Platform

Related Terms: major breaker

A Splunk Enterprise app or add-on that extends the Splunk Enterprise framework to define a custom input. Splunk Enterprise works with a modular input as if it is a Splunk Enterprise native input. Compare to scripted input .

Related Products: Platform

Modules are Splunk apps designed for the Splunk IT Service Intelligence (ITSI) App that are built from a collection of metrics, entities and service configurations. They are designed to enhance the ITSI usage experience by helping users understand and act on the data that comes from monitoring services within ITSI.

Related Products: Platform

Provides connectivity between the Splunk SOAR platform and third party security products and devices. Connector modules are written in Python and imported into Splunk SOAR as Python modules when packaged within an app.

Related Products: Platform

An SPL2 module is like a file. SPL2 modules consist of one or more related SPL2 statements. SPL2 modules are useful for grouping a set of related searches, custom functions, and custom data types.

Related Products: Platform

verb or noun The act of watching a file, directory, script output, or network port for new data. The term also refers to a configured data input of the aforementioned types. When you configure a data input for an incoming data source, you are telling Splunk Enterprise to monitor the input.

Related Products: Platform

The monitoring console is a set of dashboards, platform alerts, and health checks included in Splunk Enterprise. The dashboards provide insight into your deployment's indexing performance, search performance, operating system resource usage, app key value store performance, and license usage. The monitoring console is available only to admin users. In Splunk Enterprise versions below 6.5, the monitoring console is called the distributed management console.

Related Products: Platform

An event that spans more than one line. Events indexed from Apache logs and XML logs are often multiline events.

Related Products: Platform

An indexer cluster that spans multiple physical sites, such as data centers. Each site has its own set of peer nodes and search heads . Each site also obeys site-specific replication and search factor rules.

Related Products: Platform

Related Terms: single-site indexer cluster, search affinity

A field that exists in the Splunk platform event data that contains more than one value. Fields usually have a single value, but for events such as email logs you can often find multivalue fields in the To: and Cc: information. You can use the Search Processing Language (SPL) to modify multivalue fields. You can separate multivalue fields into multiple single value fields, or you can combine single value fields into multivalue fields.

Related Products: Platform