Monitoring Splunk

What are different between searching with index, sourcetype and host?

thinhdinh
Path Finder

Hi Experts,

Can someone explain to me what are different between searching with index, sourcetype and host? Which one give us performance better, in case we have only one host and one sourcetype? I am super confused about those concepts in Splunk. Is there any ways to check where data was transfer from by index in Splunk? Thank in advance!

0 Karma
1 Solution

thinhdinh
Path Finder

That's exactly what I am looking for, thank you @soutamo 

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!