https://community.splunk.com/t5/Getting-Data-In/How-do-Splunk-indexers-perform-indexing-without-a-parser-or/m-p/262285#M50346 <P>Hello. Start reading here: <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Aboutindexesandindexers">http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Aboutindexesandindexers</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Howindexingworks">http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Howindexingworks</A></P> <P>Thanks</P> Fri, 04 Dec 2015 12:54:26 GMT stephanefotso 2015-12-04T12:54:26Z https://community.splunk.com/t5/Getting-Data-In/How-do-Splunk-indexers-perform-indexing-without-a-parser-or/m-p/262284#M50345 <P>Hi All,</P> <P>Well, I am new to Splunk, but I have been working on other SIEM tools like RSA SA and QRadar. I just started to learn about Splunk.</P> <P>Well I want to know about Splunk indexers and how indexing happens here?</P> <P>Actually I have studied that Splunk doesn't need any parser or connector, so what I am not getting is, if there is no parser, then how is indexing happening? In all other tools, indexing is totally based on a parser. If a parser for a specific device is not available, then all logs from that device will come under unknown device.</P> <P>Maybe my question looks a bit stupid. Sorry for that, but I really want to know how indexers works and how it identifies devices and applications without any parser for that..</P> <P>Hope you understand my query, waiting for an answer...</P> <P>Thanks in advance.</P> <P>Regards,<BR /> Rajbir</P> Fri, 04 Dec 2015 07:50:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-Splunk-indexers-perform-indexing-without-a-parser-or/m-p/262284#M50345 rajveeryadav04 2015-12-04T07:50:11Z https://community.splunk.com/t5/Getting-Data-In/How-do-Splunk-indexers-perform-indexing-without-a-parser-or/m-p/262285#M50346 <P>Hello. Start reading here: <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Aboutindexesandindexers">http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Aboutindexesandindexers</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Howindexingworks">http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Howindexingworks</A></P> <P>Thanks</P> Fri, 04 Dec 2015 12:54:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-Splunk-indexers-perform-indexing-without-a-parser-or/m-p/262285#M50346 stephanefotso 2015-12-04T12:54:26Z