Can anyone explain me what's the difference between an event and a log.
According to me, an event is set of logs generated after matching a correlation.
Really you have 3 terms event
, log
, and result
.
An event
is a thing that happened anywhere at any time. It might be in Splunk and it might not. A log
is the digital exhaust
of that event; it is the plain-text vestige that indicates than an event happened. A result
is each thing
that is returned from a Splunk search.
That's interesting, Dal.
Further I have a follow up question.
Question: How can I propose splunk sizing if the customer is having existing solution in terms of events per second (EPS).
Let's say, 1000,000EPS conversion to Splunk/day license sizing.
Thanks in advance.
An "event" is any one record returned from an index or search. It could be a single log, or a single record that contains a count of logs, or a single record that says "100".
A "log" is a specific type of event, specifically documenting that something happened at a particular time.