Deployment Architecture

Splunk When and Why ?

samnik60
New Member

Hi guys,
I am a newbie to splunk, as i was reading through Splunk i understand the splunk indexes the data only during read. From my understanding

  1. isnt building the index at query time costly ?
  2. isnt indexing and other data query optimizations better when done in a datastore say oracle ( SQL ) or Hbase ( NO SQL )

I am just trying to wrap my mind on what kind of scenario i would be happy using splunk , instead of document oriented data store like
elastic search or solr and use a from end tool.

Thanks,
sam.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk indexes data as it is received from the source so it is fully indexed by the time you make your queries. Doing the indexing at query time would indeed be costly.
There are scenarios for which other datastores may be a better solution, but Splunk is quite efficient when it comes to indexing and searching text.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...