R

A compressed file in an index bucket that contains event data , as well as journal information that the indexer can use to reconstitute the index's index files . The rawdata file and the index files together constitute the files in a bucket. In an indexer cluster , a searchable copy of a bucket contains both the rawdata file and a set of index files. A non-searchable copy contains only the rawdata file.

Related Products: Platform

A type of alert that searches for events continuously in real time. Real-time alerts can trigger alert actions on a per-result basis. They can also trigger alert actions when results meet user-defined conditions within a rolling time window. For example, an admin can use a real-time alert to get a notification whenever a user has three failed logins within a ten minute period.

Related Products: Platform

A search that displays a live and continuous view of events as they stream into the Splunk platform. With real-time searches and reports, you can search events before they are indexed and preview reports as the events stream in. Unlike searches against historical data, time bounds for real-time searches continuously update. You can specify a time range that represents a sliding window of data , such as "data that has been received over the past 30 seconds." The Splunk platform uses this window to accumulate data, so you will see the data after 30 seconds pass. You can disable real-time search for an indexer and map the ability to use real-time search to specific users or roles.

Related Products: Platform

Related Terms: search, search processing language

In Platform, self-contained deployment of Splunk Observability Cloud, in which your organization is hosted. Different realms have different Observability Cloud API endpoints. For example, the endpoint for sending data in the us1 realm is https://ingest.us1.signalfx.com , while the endpoint for sending data in the eu0 realm is https://ingest.eu0.signalfx.com .

In Observability Cloud, the self-contained deployment of Splunk Observability Cloud where your organization is hosted. Different realms have different Splunk Observability Cloud API endpoints. For example, the endpoint for sending data in the us1 realm is https://ingest.us1. observability.splunkcloud.com, while the endpoint for sending data in the eu0 realm is https://ingest.eu0. observability.splunkcloud.com.

Related Products: Platform, Observability Cloud

A Splunk Enterprise instance that receives data from a forwarder . The receiver can be an indexer or a forwarder.

Related Products: Platform

The act of accepting parsed or unparsed data from a forwarder . In a Splunk Enterprise deployment , the indexer that accepts the data is the receiver . In specific cases, you can use a Heavy Forwarder as a receiver. You can forward data simultaneously from one or many forwarders to a receiver.

Related Products: Platform

A designated port on which a receiver listens for data that a forwarder sends to it.

Related Products: Platform

A bucket without full-size tsidx files . A reduced bucket has undergone the process of tsidx reduction .

Related Products: Platform

Related Terms: tsidx retention policy

A historical search with a time range where the earliest time is some number of seconds, minutes, hours, and so on, relative to "now" or the current second (the moment the search is launched). You can specify the time ranges for a relative search:

Related Products: Platform

A string of characters that you can add to a search (or saved search definition) to describe relative time ranges for a search. Relative time ranges are dependent on the time that the search was run rather than on an absolute time. For example, a relative time modifier of -60m means "60 minutes ago." Use relative time modifiers to create relative searches .

Related Products: Platform

Data that a peer node in an indexer cluster distributes to other peer nodes, so that the cluster retains multiple copies of the data. This term distinguishes such data from external data .

Related Products: Platform

In the case of an indexer cluster , the number of copies of data that the cluster maintains. A cluster can tolerate a failure of (replication factor - 1) peer nodes . On a multisite indexer cluster , a special version of the replication factor, known as the site replication factor, determines not only the number of copies that the entire cluster maintains but also the number of copies that each site maintains. In the case of a search head cluster , the minimum number of copies of each search artifact that the cluster maintains.

Related Products: Platform

Related Terms: search factor

On an indexer cluster , the port on which a peer node listens for replicated data coming from other peers. On a search head cluster , the port on which a cluster member listens for replicated search artifacts coming from other members. Note: This port is distinct from the management and receiving ports.

Related Products: Platform

A report is a type of saved search . When you create a search or pivot that you want to use later, save it as a report. You can run the report again by locating the report on the Reports listing page and clicking its name. You can schedule reports to run on a regular interval. You can configure these scheduled reports to perform actions each time they run, such as emailing the report results to a set of project stakeholders. You can accelerate slow-completing reports so that they finish faster, using either report acceleration or data model acceleration . Reports that do not qualify for report acceleration can be accelerated through summary indexing .

Related Products: Platform

A process in Splunk Enterprise that speeds up a transforming search or a report that takes a long time to finish because they run on large data sets. It creates a separate summary of the data on the indexer . It stores the summary data within ordinary indexes parallel to the bucket or buckets that cover the range of time over which the summary spans. Splunk Enterprise runs subsequent searches on the summary data, not on the _raw index, quickly returning the search results. Use Splunk Web to enable, review, and manage your report acceleration summaries.

Related Products: Platform

See transforming command .

Related Products: Platform

When you use the field extractor to create custom fields, you can specify required text to improve the accuracy of the field extraction. The regular expression created for this extraction ensures that field values are extracted only from events that contain the required text string. For example, if you use the field extractor to create a field extraction for candidate_name and candidate_id fields with the required text "Department H," then Splunk Enterprise extracts only candidate_name and candidate_id values from fields that contain the string "Department H."

Related Products: Platform

See adaptive response action .

Related Products: Platform

A guide with predefined tasks and phases for a particular incident response in Splunk Mission Control. After you add a response template to an incident, it becomes a response plan. Any changes you make to the response plan do not apply to the original response template and instead only apply to the investigation of that specific incident.

Related Products: Platform

A plan that provides standardized guidelines for response tasks and phases that security analysts perform when investigating and responding to incidents in Splunk Mission Control.

Related Products: Platform

Related Terms: adaptive response action, response plan, intelligence workflow

Use the Splunk REST API to interact with resources in a deployment. Run searches, monitor the deployment, and manage configurations or objects . REST API endpoints are served from the splunkd server. Operations on an endpoint can have required parameters and might have capability restrictions. Depending on the operation, responses from endpoints can include values representing resource state and/or other details. The REST API supports typical create, read, update, and delete options using the following operations.

Related Products: Platform

The output produced in the Search app after transforming commands run on events . Since the search commands have processed the events, they're no longer considered events anymore. For example, the following search produces results. index="_internal" | head 50 | stats count by sourcetype The results of the search look like this: The output in the table was computed from the original events; the source types in the output are derived from events, but they no longer map to a particular event.

Related Products: Platform

A set of rules or tuning factors to dynamically calculate risk scores for an entity, such as an asset , identity , user, or device. You can use risk factors to precisely isolate threats and prioritize suspicious behavior with Splunk Enterprise Security. Using risk factors, you can increase or decrease the original risk score with addition or multiplication operations. For example, you can increase the risk score on a laptop, which might be targeted because it belongs to a director of a company, by a factor of two.

Related Products: Platform, Enterprise Security

Related Terms: risk factor editor

An interactive editor available from Splunk Enterprise Security to create and edit risk factors without writing any XML code.

Related Products: Platform, Enterprise Security

Related Terms: risk score

A unique message to describe risk activity and add context to an investigation in Splunk Enterprise Security.

Related Products: Platform, Enterprise Security

An event that modifies risk. In the risk index, risk modifiers contain the following fields at a minimum: risk score , risk_object , and risk_object_type . Risk modifiers are key to calculating risk scores and assigning risk scores to risk objects .

Related Products: Platform

A type of notable event that contains a risk score . Risk notables are automatically created when a risk incident rule associates a risk score with a risk object , such as an asset , identity , user, or device.

Related Products: Platform

Related Terms: incident, observable, artifact, notable event

Any entity such as an asset , identity , user, or device in your network that generates machine data, which can be used by Splunk Enterprise Security to populate lookups and provide context to identify potential security threats.

Related Products: Platform, Enterprise Security

A correlation search that adds events to the risk index using the risk analysis adaptive response action.

Related Products: Platform

Related Terms: risk incident rule

A single metric that shows the relative risk of an entity. When a risk score surpasses a specified threshold over a period of time, analysts can focus their efforts on potentially connected behaviors associated with the entity to identify security threats. The risk score of an asset or identity is the sum of all the risk scores for risk events in the risk index that apply to the specific asset or identity over a period of time.

Related Products: Platform

Related Terms: passthru score, normalized score

A collection of permissions and capabilities that defines a user function in the Splunk platform. Splunk platform users can have one or more roles.

Related Products: Platform

"Rolling-window alert" is a term previously used for a real-time alert with rolling time window triggering. See real-time alert .

Related Products: Platform