Splunk Search

Splunk Data Fabric Search(DFS) basics

Super Champion

Data Fabric Search - DFS overview
Data Fabric Search (DFS) is the new search platform that leverages the distributed processing power of external compute engines (Apache Spark Core) to broaden the scope and capability of the Splunk Enterprise.
Update - The document link -

Hi All, ...As i read this from the Splunk DFS docs, i feel like - instead of using a Splunk Search Head Cluster(SHC), this DFS concepts will be using the external compute engines(Apache Spark Core) and produce the similar results, thus by reducing the Search heads count, thus the reduced cost and time. may i know if this is correct?

(DFS/"Data Fabric Search" tags are not available yet, it seems only admins can create the tags)

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

Splunk Employee
Splunk Employee

Splunk DFS 1.1 does not yet support all of the SPL that comes with Splunk Enterprise. But for what it does support, it can offload onto the Spark cluster and run big jobs faster. Today's release of Splunk DFS Manager app v1.2 https://splunkbase.splunk.com/app/4745/ in Splunkbase makes managing the Spark cluster quite easy if you're already running Splunk 8.0.x or later. And with Splunk 8.0.x, you get free vCPU credits to use with Splunk DFS for licenses >1Tb.


Yes the computation for things like stats can be done on the Spark nodes instead of the indexers. Even better many many events can be worked on. More than possible in Splunk today.

The slides from last year's Splunk user conference on DFS might help you.

You can search for data fabric search on conf.splunk.com

Here's the link from that site


Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...