topic event store format in Getting Data In

event store format

Bhaskarchourasi — Thu, 01 Nov 2018 19:38:27 GMT

Hi All,

I am very new to Splunk and would like to know in which format logs got store in indexer. like arcsight uses CEF and Qradar uses LEEF.

Thanks in advance.

Re: event store format

FrankVl — Fri, 02 Nov 2018 09:25:34 GMT

Splunk doesn't have schema at write like ArcSight. Apart from a few meta data fields like host, source, sourcetype, it basically stores the raw event and a bunch of indexing next to that to speed up searching. Most field extraction (and normalization into models like Splunk's Common Information Model) happen only at search time.

This documentation explains it a bit further: http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkdoeswithyourdata

Re: event store format

inventsekar — Fri, 02 Nov 2018 09:45:15 GMT

I am very new to Splunk and would like to know in which format logs got store in indexer -
That is internal to splunk. Splunk uses its "propitiatory" logics to save the logs.
https://answers.splunk.com/answers/389416/about-splunk-backend.html

Actually we may never need to understand how splunk stores the logs.
we are never going to check the files "directly" (like viewing/editing using vi editor or notepad)

like arcsight uses CEF and Qradar uses LEEF - Good details to learn. thanks.