Getting Data In

What is the distinction between parsed , unparsed , and raw data?

Splunk Employee
Splunk Employee

What processsing does the light forwarder do when sending unparsed data, to distinguish what it does with raw data? Similarly, what further processing does a regular forwarder perform when sending parsed data?

Tags (1)


Does rawdata are lighter ?

0 Karma

Splunk Employee
Splunk Employee

per gkanapathy:

raw is not at all touched by splunk, usually only used for forwarding syslog to non-splunk systems, etc.

unparsed cooked data is raw data that has been "enhanced" with Splunk-specific information about the source of the data, e.g., host name, destination index, sourcetype, source. (incidentally, these pieces of info are sometimes called "keys"). The common thing about these pieces of data is they apply to the source/input as a whole and do not vary with individual events. In fact, in unparsed data, individual events have not even necessarily been identified.

parsed/cooked data has had each individual event examined and annotated with the keys, plus new fields and key values that may be different in each individual event. The raw data has been broken down into separate lines, the lines may have been read, merged into multi-line events, the resulting events read by the transforms processor, and various indexed field values set or overridden event by event.

See this too:

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...