Splunk Search

Cooked Connection

JarrettM
Path Finder

A Google search indicates that that using the term "cooked" in realation to a network connection is exclusive to Splunk. What exactly is meant by "cooked connection" or "cooked ssl?"

Thanks!

Tags (1)
1 Solution

xpac
SplunkTrust
SplunkTrust

The term cooked is sadly used pretty inconsistently with Splunk.

With regard to network connections, a cooked connection (as mentioned in some Splunk logs) is a S2S (Splunk to Splunk) connection, based on a proprietary protocol.

However, in outputs.conf and elsewhere, cooked data refers to data that has already been parsed by a full Splunk instance, like a heavy forwarder.
In that case, cooked means parsed, and you should note that such data that arrives on another full Splunk instance is not parsed again, i.e. it's not going to be subject to props.conf index time procedures again.

Data that is being sent from a. Universal Forwarder is not cooked - but it's using a cooked connection to send it.

Hope that you're know properly confused. 😉

View solution in original post

somesoni2
Revered Legend

Cooked connection denotes communications between two Splunk nodes as opposed to Raw connections which refer to non-Splunk nodes passing their data to Splunk.

0 Karma

JarrettM
Path Finder

Thanks for your answer. I would accept it but xpac beat you too it by an hour.

Thanks again!

0 Karma

xpac
SplunkTrust
SplunkTrust

The term cooked is sadly used pretty inconsistently with Splunk.

With regard to network connections, a cooked connection (as mentioned in some Splunk logs) is a S2S (Splunk to Splunk) connection, based on a proprietary protocol.

However, in outputs.conf and elsewhere, cooked data refers to data that has already been parsed by a full Splunk instance, like a heavy forwarder.
In that case, cooked means parsed, and you should note that such data that arrives on another full Splunk instance is not parsed again, i.e. it's not going to be subject to props.conf index time procedures again.

Data that is being sent from a. Universal Forwarder is not cooked - but it's using a cooked connection to send it.

Hope that you're know properly confused. 😉

View solution in original post

JarrettM
Path Finder

Thanks, that is actually quite clear. It just seems strange to me that Splunk would use a non-standard term like that and not really explain it anywhere (at least that I can find)

Thanks again!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!