Splunk_Server Field retrieved upon splunk search


Is Splunk_Server field a internal field that values cannot be set.

Tags (2)
0 Karma

Ultra Champion

This is an internal field that specifys which Splunk Indexer the event was retrieved from.

In a distributed architecture you might have several Splunk Indexers (aka Search Peers) that your event data is stored across.

0 Karma