Getting Data In

What is the distinction between parsed , unparsed , and raw data?

Splunk Employee
Splunk Employee

What processsing does the light forwarder do when sending unparsed data, to distinguish what it does with raw data? Similarly, what further processing does a regular forwarder perform when sending parsed data?

Tags (1)


Does rawdata are lighter ?

0 Karma

Splunk Employee
Splunk Employee

per gkanapathy:

raw is not at all touched by splunk, usually only used for forwarding syslog to non-splunk systems, etc.

unparsed cooked data is raw data that has been "enhanced" with Splunk-specific information about the source of the data, e.g., host name, destination index, sourcetype, source. (incidentally, these pieces of info are sometimes called "keys"). The common thing about these pieces of data is they apply to the source/input as a whole and do not vary with individual events. In fact, in unparsed data, individual events have not even necessarily been identified.

parsed/cooked data has had each individual event examined and annotated with the keys, plus new fields and key values that may be different in each individual event. The raw data has been broken down into separate lines, the lines may have been read, merged into multi-line events, the resulting events read by the transforms processor, and various indexed field values set or overridden event by event.

See this too:

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...