O
object
See knowledge object .
Related Products: Platform
observable
A piece of data indicating an event that has occurred or been observed on a computer system, network, or other digital entity. Observables can be malicious or benign. For example, if someone uses an IP address to download a malicious program onto a computer, the IP address and computer are the observables, while the download of the malicious program is the event. In Splunk Mission Control, Threat Intelligence Management records observables as part of an incident .
Related Products: Platform
Related Terms: indicator, threat object
orchestrating command
A search command that controls some aspect of how the search is processed. It does not directly affect the final result set of the search. For example, you might apply the noop command to a search to enable or disable a search optimization that helps the overall search complete faster. Other examples of orchestrating commands include redistribute and localop . The lookup command also becomes an orchestrating command when you use it with the local=t argument.
Related Products: Platform
output group
One or more indexers ( receivers ) to which you configure a forwarder to send data. You define an output group in outputs.conf with the tcpout:<target group> stanza, where you specify one or more indexers that are configured as receivers. The forwarder uses the target group stanza to send data to those receivers.
Related Products: Platform