Cooked Connection

[JarrettM]

A Google search indicates that that using the term "cooked" in realation to a network connection is exclusive to Splunk. What exactly is meant by "cooked connection" or "cooked ssl?"

Thanks!

[somesoni2]

Cooked connection denotes communications between two Splunk nodes as opposed to Raw connections which refer to non-Splunk nodes passing their data to Splunk.

[JarrettM]

Thanks for your answer. I would accept it but xpac beat you too it by an hour.

Thanks again!

[xpac · Accepted solution]

The term cooked is sadly used pretty inconsistently with Splunk.

With regard to network connections, a cooked connection (as mentioned in some Splunk logs) is a S2S (Splunk to Splunk) connection, based on a proprietary protocol.

However, in outputs.conf and elsewhere, cooked data refers to data that has already been parsed by a full Splunk instance, like a heavy forwarder.
In that case, cooked means parsed, and you should note that such data that arrives on another full Splunk instance is not parsed again, i.e. it's not going to be subject to props.conf index time procedures again.

Data that is being sent from a. Universal Forwarder is not cooked - but it's using a cooked connection to send it.

Hope that you're know properly confused. 😉

[JarrettM]

Thanks, that is actually quite clear. It just seems strange to me that Splunk would use a non-standard term like that and not really explain it anywhere (at least that I can find)

Thanks again!