Getting Data In

What is the distinction between parsed , unparsed , and raw data?

Splunk Employee
Splunk Employee

What processsing does the light forwarder do when sending unparsed data, to distinguish what it does with raw data? Similarly, what further processing does a regular forwarder perform when sending parsed data?

Tags (1)


Does rawdata are lighter ?

0 Karma

Splunk Employee
Splunk Employee

per gkanapathy:

raw is not at all touched by splunk, usually only used for forwarding syslog to non-splunk systems, etc.

unparsed cooked data is raw data that has been "enhanced" with Splunk-specific information about the source of the data, e.g., host name, destination index, sourcetype, source. (incidentally, these pieces of info are sometimes called "keys"). The common thing about these pieces of data is they apply to the source/input as a whole and do not vary with individual events. In fact, in unparsed data, individual events have not even necessarily been identified.

parsed/cooked data has had each individual event examined and annotated with the keys, plus new fields and key values that may be different in each individual event. The raw data has been broken down into separate lines, the lines may have been read, merged into multi-line events, the resulting events read by the transforms processor, and various indexed field values set or overridden event by event.

See this too:

Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...