Splunk Search

Cooked Connection

JarrettM
Path Finder

A Google search indicates that that using the term "cooked" in realation to a network connection is exclusive to Splunk. What exactly is meant by "cooked connection" or "cooked ssl?"

Thanks!

Tags (1)
1 Solution

xpac
SplunkTrust
SplunkTrust

The term cooked is sadly used pretty inconsistently with Splunk.

With regard to network connections, a cooked connection (as mentioned in some Splunk logs) is a S2S (Splunk to Splunk) connection, based on a proprietary protocol.

However, in outputs.conf and elsewhere, cooked data refers to data that has already been parsed by a full Splunk instance, like a heavy forwarder.
In that case, cooked means parsed, and you should note that such data that arrives on another full Splunk instance is not parsed again, i.e. it's not going to be subject to props.conf index time procedures again.

Data that is being sent from a. Universal Forwarder is not cooked - but it's using a cooked connection to send it.

Hope that you're know properly confused. :winking_face:

View solution in original post

somesoni2
Revered Legend

Cooked connection denotes communications between two Splunk nodes as opposed to Raw connections which refer to non-Splunk nodes passing their data to Splunk.

0 Karma

JarrettM
Path Finder

Thanks for your answer. I would accept it but xpac beat you too it by an hour.

Thanks again!

0 Karma

xpac
SplunkTrust
SplunkTrust

The term cooked is sadly used pretty inconsistently with Splunk.

With regard to network connections, a cooked connection (as mentioned in some Splunk logs) is a S2S (Splunk to Splunk) connection, based on a proprietary protocol.

However, in outputs.conf and elsewhere, cooked data refers to data that has already been parsed by a full Splunk instance, like a heavy forwarder.
In that case, cooked means parsed, and you should note that such data that arrives on another full Splunk instance is not parsed again, i.e. it's not going to be subject to props.conf index time procedures again.

Data that is being sent from a. Universal Forwarder is not cooked - but it's using a cooked connection to send it.

Hope that you're know properly confused. :winking_face:

JarrettM
Path Finder

Thanks, that is actually quite clear. It just seems strange to me that Splunk would use a non-standard term like that and not really explain it anywhere (at least that I can find)

Thanks again!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...