https://community.splunk.com/t5/Training-Certification/Splunk-Fundamental/m-p/476061#M1086 <P>Difference between parsed and indexed data in SPLUNK</P> Tue, 07 Jan 2020 15:29:26 GMT bhavin_crest 2020-01-07T15:29:26Z https://community.splunk.com/t5/Training-Certification/Splunk-Fundamental/m-p/476061#M1086 <P>Difference between parsed and indexed data in SPLUNK</P> Tue, 07 Jan 2020 15:29:26 GMT https://community.splunk.com/t5/Training-Certification/Splunk-Fundamental/m-p/476061#M1086 bhavin_crest 2020-01-07T15:29:26Z https://community.splunk.com/t5/Training-Certification/Splunk-Fundamental/m-p/476062#M1087 <P>Hi @bhavin_crest,<BR /> parsing and Indexing are two different phases of the ingestion pipeline.<BR /> Here you can find a description <A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Howindexingworks">https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Howindexingworks</A></P> <P>In few words:</P> <UL> <LI>during parsing is prepared all that will be indexed (fields, econding, etc...),</LI> <LI>during indexing Splunk write the raw data and index files to disk.</LI> </UL> <P>Ciao.<BR /> Giuseppe</P> Tue, 07 Jan 2020 16:58:08 GMT https://community.splunk.com/t5/Training-Certification/Splunk-Fundamental/m-p/476062#M1087 gcusello 2020-01-07T16:58:08Z