event store format

[Bhaskarchourasi]

Hi All,

I am very new to Splunk and would like to know in which format logs got store in indexer. like arcsight uses CEF and Qradar uses LEEF.

Thanks in advance.

[inventsekar]

I am very new to Splunk and would like to know in which format logs got store in indexer -
That is internal to splunk. Splunk uses its "propitiatory" logics to save the logs.
https://answers.splunk.com/answers/389416/about-splunk-backend.html

Actually we may never need to understand how splunk stores the logs.
we are never going to check the files "directly" (like viewing/editing using vi editor or notepad)

like arcsight uses CEF and Qradar uses LEEF - Good details to learn. thanks.

[FrankVl]

Splunk doesn't have schema at write like ArcSight. Apart from a few meta data fields like host, source, sourcetype, it basically stores the raw event and a bunch of indexing next to that to speed up searching. Most field extraction (and normalization into models like Splunk's Common Information Model) happen only at search time.

This documentation explains it a bit further: http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkdoeswithyourdata