(contains excerpts from docs.splunk.com)
Splunk is a log processing platform which stores compressed logs and indexes them for faster search. Splunk Enterprise in it's minimal installation has the following components: Forwarder, Indexer, Index and Search Head.
Index
Splunk Enterprise can index any type of time-series data (data with timestamps). When Splunk Enterprise indexes data, it breaks it into events, based on the timestamps.
What's in an index?
Splunk Enterprise stores the data it processes in indexes. An index consists of a collection of subdirectories, called buckets. Buckets consist mainly of two types of files: rawdata files and index files.
Immutability of indexed data
Once data has been added to an index, you cannot edit or otherwise change the data. You can delete all data from an index or you can delete, and optionally archive, individual index buckets based on policy, but you cannot selectively delete individual events from storage.
Default set of indexes
Splunk Enterprise comes with a number of preconfigured indexes, including:
main: This is the default Splunk Enterprise index. All processed data is stored here unless otherwise specified.
_internal: Stores Splunk Enterprise internal logs and processing metrics.
_audit: Contains events related to the file system change monitor, auditing, and all user search history.
The data pipeline
The processing tiers in a Splunk deployment correspond to the data pipeline, which is the route that data takes through Splunk software.
The processing tiers and the data pipeline
A Splunk deployment typically has three processing tiers:
Data input
Indexing
Search management
Each Splunk processing component resides on one of the tiers. Together, the tiers support the processes occurring in the data pipeline.
As data moves along the data pipeline, Splunk components transform the data from its origin in external sources, such as log files and network feeds, into searchable events that encapsulate valuable knowledge.
The data pipeline has these segments:
The correspondence between the three typical processing tiers and the four data pipeline segments is this:
The data input tier handles the input segment.
The indexing tier handles the parsing and indexing segments.
The search management tier handles the search segment.
This diagram outlines the data pipeline:
Splunk components participate in one or more segments of the data pipeline. See "Components and the data pipeline."
Note: The diagram represents a simplified view of the indexing architecture. It provides a functional view of the architecture and does not fully describe Splunk software internals. In particular, the parsing pipeline actually consists of three pipelines: parsing, merging, and typing, which together handle the parsing function. The distinction can matter during troubleshooting, but does not ordinarily affect how you configure or deploy Splunk Enterprise components. For a more detailed diagram of the data pipeline, see "How Indexing Works" in the Community Wiki.
The data pipeline segments in depth
This section provides more detail about the segments of the data pipeline. For more information on the parsing and indexing segments, see also "How indexing works" in the Managing Indexers and Clusters of Indexers manual.
Input
In the input segment, Splunk software consumes data. It acquires the raw data stream from its source, breaks it into 64K blocks, and annotates each block with some metadata keys. The keys apply to the entire input source overall. They include the host, source, and source type of the data. The keys can also include values that are used internally, such as the character encoding of the data stream, and values that control later processing of the data, such as the index into which the events should be stored.
During this phase, Splunk software does not look at the contents of the data stream, so the keys apply to the entire source, not to individual events. In fact, at this point, Splunk software has no notion of individual events at all, only of a stream of data with certain global properties.
Parsing
During the parsing segment, Splunk software examines, analyzes, and transforms the data. This is also known as event processing. It is during this phase that Splunk software breaks the data stream into individual events.The parsing phase has many sub-phases:
Breaking the stream of data into individual lines.
Identifying, parsing, and setting timestamps.
Annotating individual events with metadata copied from the source-wide keys.
Transforming event data and metadata according to regex transform rules.
Indexing
During indexing, Splunk software takes the parsed events and writes them to the index on disk. It writes both compressed raw data and the corresponding index files.
For brevity, parsing and indexing are often referred together as the indexing process. At a high level, that makes sense. But when you need to examine the actual processing of data more closely or decide how to allocate your components, it can be important to consider the two segments individually.
Search
The search segment manages all aspects of how the user accesses, views, and uses the indexed data. As part of the search function, Splunk software stores user-created knowledge objects, such as reports, event types, dashboards, alerts, and field extractions. The search function also manages the search process itself.
Comments