Getting Data In

What is the distinction between parsed , unparsed , and raw data?

Steve_G_
Splunk Employee
Splunk Employee

What processsing does the light forwarder do when sending unparsed data, to distinguish what it does with raw data? Similarly, what further processing does a regular forwarder perform when sending parsed data?

Tags (1)

ddarmand
Communicator

Does rawdata are lighter ?

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

per gkanapathy:

raw is not at all touched by splunk, usually only used for forwarding syslog to non-splunk systems, etc.

unparsed cooked data is raw data that has been "enhanced" with Splunk-specific information about the source of the data, e.g., host name, destination index, sourcetype, source. (incidentally, these pieces of info are sometimes called "keys"). The common thing about these pieces of data is they apply to the source/input as a whole and do not vary with individual events. In fact, in unparsed data, individual events have not even necessarily been identified.

parsed/cooked data has had each individual event examined and annotated with the keys, plus new fields and key values that may be different in each individual event. The raw data has been broken down into separate lines, the lines may have been read, merged into multi-line events, the resulting events read by the transforms processor, and various indexed field values set or overridden event by event.

See this too:

http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F

Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...