Dashboards & Visualizations

Where can I find information on when SPL parses machine data?

lucalikesplunk
New Member

Hello!

I've been reading about Splunk Enterprise being 'schema on read' and the Elastic Stack being 'schema on write'. I.e. Splunk SPL parses/formats/enriches machine data in query time as opposed to doing it in index time as with Elasticsearch. This is stated in several articles on the internet but I can't seem to find any information about this in Splunk's official documentation? I would greatly appreciate it if someone pointed me in the right direction.

Tags (1)
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Take a look at this on Splunk's data pipeline: https://docs.splunk.com/Documentation/Splunk/7.2.5/Deploy/Datapipeline

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...