topic Re: Is there a guide or map to understand Splunk's internal indexes and their log content? in Splunk Search

Is there a guide or map to understand Splunk's internal indexes and their log content?

feickertmd — Mon, 28 Sep 2020 18:14:53 GMT

Does there exist some sort of map or guide to understanding Splunk's internal indexes (_internal, _audit, _introspection)? Something like:
_internal sourcetypes splunkd fields per_user_thruput (description of value data)

I have found and been given a few great examples as well as hacked up some splunk on splunk dashboards, but I would like to know what logs contain what so that we can build some additional auditing reports.

Re: Is there a guide or map to understand Splunk's internal indexes and their log content?

ChrisG — Fri, 21 Nov 2014 18:38:41 GMT

There is a topic in the Troubleshooting Manual that provides a summary of what Splunk Enterprise logs about itself, with links to more detailed information when it is available. Is that the material you are looking for?

Re: Is there a guide or map to understand Splunk's internal indexes and their log content?

feickertmd — Fri, 21 Nov 2014 18:47:15 GMT

Close, but no cigar. It does tell me what logs it covers, but very little about what those logs contain or what their fields represent.

Re: Is there a guide or map to understand Splunk's internal indexes and their log content?

ChrisG — Fri, 21 Nov 2014 18:51:31 GMT

Got it. There is some additional information in the topics that follow the one I previously linked, including some field information, but there isn't any comprehensive reference to the log files and fields in the documentation.

Re: Is there a guide or map to understand Splunk's internal indexes and their log content?

halr9000 — Fri, 21 Nov 2014 21:13:57 GMT

Actually, with version 6.0 some of what you want exists as sample data models included in the Search app. Go to Settings / Data Models, and choose the Search app and you'll see this:

Re: Is there a guide or map to understand Splunk's internal indexes and their log content?

feickertmd — Mon, 24 Nov 2014 14:07:24 GMT

A thing of beauty!