Splunk Search

Cooked Connection

JarrettM
Path Finder

A Google search indicates that that using the term "cooked" in realation to a network connection is exclusive to Splunk. What exactly is meant by "cooked connection" or "cooked ssl?"

Thanks!

Tags (1)
1 Solution

xpac
SplunkTrust
SplunkTrust

The term cooked is sadly used pretty inconsistently with Splunk.

With regard to network connections, a cooked connection (as mentioned in some Splunk logs) is a S2S (Splunk to Splunk) connection, based on a proprietary protocol.

However, in outputs.conf and elsewhere, cooked data refers to data that has already been parsed by a full Splunk instance, like a heavy forwarder.
In that case, cooked means parsed, and you should note that such data that arrives on another full Splunk instance is not parsed again, i.e. it's not going to be subject to props.conf index time procedures again.

Data that is being sent from a. Universal Forwarder is not cooked - but it's using a cooked connection to send it.

Hope that you're know properly confused. 😉

View solution in original post

somesoni2
Revered Legend

Cooked connection denotes communications between two Splunk nodes as opposed to Raw connections which refer to non-Splunk nodes passing their data to Splunk.

0 Karma

JarrettM
Path Finder

Thanks for your answer. I would accept it but xpac beat you too it by an hour.

Thanks again!

0 Karma

xpac
SplunkTrust
SplunkTrust

The term cooked is sadly used pretty inconsistently with Splunk.

With regard to network connections, a cooked connection (as mentioned in some Splunk logs) is a S2S (Splunk to Splunk) connection, based on a proprietary protocol.

However, in outputs.conf and elsewhere, cooked data refers to data that has already been parsed by a full Splunk instance, like a heavy forwarder.
In that case, cooked means parsed, and you should note that such data that arrives on another full Splunk instance is not parsed again, i.e. it's not going to be subject to props.conf index time procedures again.

Data that is being sent from a. Universal Forwarder is not cooked - but it's using a cooked connection to send it.

Hope that you're know properly confused. 😉

JarrettM
Path Finder

Thanks, that is actually quite clear. It just seems strange to me that Splunk would use a non-standard term like that and not really explain it anywhere (at least that I can find)

Thanks again!

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...