Enlist major components of Splunk?


Posted On: Mar 12, 2020


The three main components in Splunk are

  1. Splunk Forwarder,
  2. Splunk Indexer, and
  3. Splunk Head.

Splunk Forwarder - This component is used for collecting logs. They are independent of the main Splunk instance and are used to collect logs from the remote machine. After collecting the logs, the Splunk Forwarder will forward the log data to a Splunk Indexer for processing and storage.

Splunk Indexer - It is used for indexing and storing the data from the Splunk forwarder. As it indexes the data, the Splunk Indexer creates a number of files. These files contain any one of either item like the raw data in compressed form or the indexes that point to raw data.

Splunk Search Head - This component is used for interacting with the Splunk. It provides GUI for the user to do various operations with the Splunk.

    Related Questions

    Please Login or Register to leave a response.

    Related Questions

    Splunk Interview Questions

    What is Splunk?

    Splunk is a software technology which is the first data to everything platform. It is mainly used for monitoring, searching, analyzing, and visualizing the machine-generated data in the real-time. It ...

    Splunk Interview Questions

    What is Splunk Indexer?

    The Indexer is one of the components present in the Splunk which is used for indexing and storing the data coming from the forwarder. It transforms the incoming data into events and stores the event i...