topic Re: Indexed and not indexed data in Getting Data In

Indexed and not indexed data

gdfasdasd — Wed, 22 May 2024 10:09:00 GMT

hello,

i am new in splunk. i can not understand if i not indexed data in can i search this data in Splunk? or only indexed data can i search in Splunk?

Re: Indexed and not indexed data

gcusello — Wed, 22 May 2024 10:15:57 GMT

Hi @gdfasdasd,

only indexed data obviously!

Ciao.

Giuseppe

Re: Indexed and not indexed data

gdfasdasd — Wed, 22 May 2024 10:29:42 GMT

i want to use Splunk as a log server. Send any data but filter they from index which do not pass license. if data not pass in indexer i can not search this data?

Re: Indexed and not indexed data

gdfasdasd — Wed, 22 May 2024 10:31:51 GMT

Some forum i read that all data can search in splunk indexed or not indexed is it incorrect inforamtion?

Re: Indexed and not indexed data

ITWhisperer — Wed, 22 May 2024 10:32:36 GMT

Strictly speaking, there are other ways to access non-indexed data such as DB Connect and inputlookup, but generally speaking you should index your data (as @gcusello suggested) in order to get powerful access to the information contained within it.

Re: Indexed and not indexed data

gcusello — Wed, 22 May 2024 10:36:45 GMT

Hi @gdfasdasd ,

I don't know which forums are you speaking of,.

as also @ITWhisperer said, you can access external data without indexing them e.g. using DB-Connect (that's a Splunk JDBC client to query Databases), but in this case, you have to forget performances from your system!

In Splunk you can mainly search only on indexed data.

Ciao.

Giuseppe

Re: Indexed and not indexed data

gdfasdasd — Wed, 22 May 2024 10:38:21 GMT

https://community.splunk.com/t5/Splunk-Search/Searching-data-that-is-not-indexed/m-p/557435

i read this information

Re: Indexed and not indexed data

gcusello — Wed, 22 May 2024 10:45:30 GMT

Hi @gdfasdasd ,

in the post is written also: 'if Splunk has the data - it is indexed and searchable', so only indexed data are searchable.

If you discard an event and you don't index it, you cannot search it.

So I confirm, that you can search only on indexed data, with the exception of DB-Connect with performances to forget.

Ciao.

Giuseppe