Splunk Fundamental

[bhavin_crest]

Difference between parsed and indexed data in SPLUNK

[gcusello · Accepted solution]

Hi @bhavin_crest,
parsing and Indexing are two different phases of the ingestion pipeline.
Here you can find a description https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Howindexingworks

In few words:

• during parsing is prepared all that will be indexed (fields, econding, etc...),
• during indexing Splunk write the raw data and index files to disk.

Ciao.
Giuseppe