Training + Certification

Splunk Fundamental

bhavin_crest
Explorer

Difference between parsed and indexed data in SPLUNK

Tags (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @bhavin_crest,
parsing and Indexing are two different phases of the ingestion pipeline.
Here you can find a description https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Howindexingworks

In few words:

  • during parsing is prepared all that will be indexed (fields, econding, etc...),
  • during indexing Splunk write the raw data and index files to disk.

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi @bhavin_crest,
parsing and Indexing are two different phases of the ingestion pipeline.
Here you can find a description https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Howindexingworks

In few words:

  • during parsing is prepared all that will be indexed (fields, econding, etc...),
  • during indexing Splunk write the raw data and index files to disk.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...