Deployment Architecture

Splunk When and Why ?

New Member

Hi guys,
I am a newbie to splunk, as i was reading through Splunk i understand the splunk indexes the data only during read. From my understanding

  1. isnt building the index at query time costly ?
  2. isnt indexing and other data query optimizations better when done in a datastore say oracle ( SQL ) or Hbase ( NO SQL )

I am just trying to wrap my mind on what kind of scenario i would be happy using splunk , instead of document oriented data store like
elastic search or solr and use a from end tool.


Tags (1)
0 Karma


Splunk indexes data as it is received from the source so it is fully indexed by the time you make your queries. Doing the indexing at query time would indeed be costly.
There are scenarios for which other datastores may be a better solution, but Splunk is quite efficient when it comes to indexing and searching text.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...