Getting Data In

about Splunk Backend?

4Name
Explorer

Hello,

I have several questions about splunk's backend to which I was unable to find a clear answer :

1) What is Splunk Based on?
It's a NoSQL model but is it based on something existant or is it fully developped by Splunk?

2) Hos does Splunk handles logs' new data?
How does it knows where to stop the crawling? or does it crawls the entire files at every check?

Thanks for your answers!

1 Solution

ChrisG
Splunk Employee
Splunk Employee

Splunk indexing and storage technology is proprietary and is not based on open source packages.

For your second question, Splunk software uses a tailing processor to follow incremental changes to log files. For more information about the indexing process in general, read How indexing works in the Managing Indexers and Clusters of Indexers manual.

View solution in original post

ddrillic
Ultra Champion

The second question is about an interesting subject. http://docs.splunk.com/Documentation/Splunk/6.0.5/Data/Howlogfilerotationishandled is fascinating.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Splunk indexing and storage technology is proprietary and is not based on open source packages.

For your second question, Splunk software uses a tailing processor to follow incremental changes to log files. For more information about the indexing process in general, read How indexing works in the Managing Indexers and Clusters of Indexers manual.

4Name
Explorer

Thanks a lot ChrisG! 🙂

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...