- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Experts,
Can someone explain to me what are different between searching with index, sourcetype and host? Which one give us performance better, in case we have only one host and one sourcetype? I am super confused about those concepts in Splunk. Is there any ways to check where data was transfer from by index in Splunk? Thank in advance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi
I hope that the next links will help you:
- https://docs.splunk.com/Documentation/SplunkCloud/8.0.2004/Data/Aboutdefaultfields
- https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchTutorial/Startsearching
r. Ismo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi
I hope that the next links will help you:
- https://docs.splunk.com/Documentation/SplunkCloud/8.0.2004/Data/Aboutdefaultfields
- https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchTutorial/Startsearching
r. Ismo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's exactly what I am looking for, thank you @isoutamo
