Monitoring Splunk

What are different between searching with index, sourcetype and host?

Path Finder

Hi Experts,

Can someone explain to me what are different between searching with index, sourcetype and host? Which one give us performance better, in case we have only one host and one sourcetype? I am super confused about those concepts in Splunk. Is there any ways to check where data was transfer from by index in Splunk? Thank in advance!

0 Karma
1 Solution

Path Finder

That's exactly what I am looking for, thank you @soutamo 

0 Karma