• Start Here
  • Splunk Architecture
  • How-To FAQ
    • Rebrand the Splunk Web Interface
    • Customize the Splunk Web Interface's Layout and Behavior
    • Launch Splunk from Your Interface
    • Search with Splunk from another application
    • Manage Splunk setting and users from another application
    • Send Live Splunk alerts to another application
    • Preconfigure, customize or tune specific data inputs
    • Preload Saved and Live Splunks
    • Add processing not available through configuration alone
    • Access data not supported by Splunk's built-in input modules
• Command Line Interface
  • How Splunk Uses the CLI
    • Examples
  • Authentication
    • Command Authentication
    • Parameters
    • Examples
    • Session Authentication
    • Examples
  • Search
    • Actions
    • Default Argument
    • Parameters
    • Example
  • User Accounts
    • Actions
    • Default Argument
    • Parameters
    • Examples
  • Data Inputs
    • Actions
    • Contexts
    • Default Argument
    • Parameters
  • Settings
    • Actions
    • Contexts
    • Default Argument
    • Parameters
    • Examples
  • Splunk-2-Splunk
    • Actions
    • Contexts
    • Default Argument
    • Parameters
    • Examples
  • Summaries
    • Actions
    • Contexts
    • Default Argument
    • Parameters
  • Controls
    • Actions
    • Contexts
    • Default Argument
    • Parameters
    • Examples
• SOAP API
  • How Splunk uses SOAP
    • Python Control Layer
    • Environment
    • Authentication
    • Example
  • Using the PCL to Make SOAP Requests
    • Authentication Example
    • Search Example
  • Additional PCL Search Examples
    • output
    • get
  • Creating SOAP Requests
    • Observing PCL SOAP Calls
    • Creating a SOAP Call
    • executeQuery.pl
  • SOAP Message Examples
    • Login
    • Execute Query
• Bundles
  • How Bundles Work
    • Startup
    • Typical Uses
    • Example files
  • Add & Override Properties
    • Filename
    • Format
    • Spec
    • Attributes
    • Linemerging
    • Timestamp extraction configuration
    • Typing configuration
    • Regex configuration
    • Source Type configuration
    • Examples
  • Create Regular Expressions
    • Filename
    • Format
    • Attributes
    • Splunk Reserved Keys
    • Examples
  • Add Input Configurations
    • Filename
    • Format
    • Input Types
    • Attributes
    • Additional Attributes
    • Examples
  • Recognize Source Types
    • Filename
    • Format
    • Examples
  • Authentication Configuration
    • Filename
    • Format
  • Live Splunks and Saved Splunks Configuration
    • Filenames
    • Format
    • Live Splunk Alert via Email
• Modules
  • How Modules Work
    • Startup
    • Typical Uses
  • Customizing the Universal Pipeline
  • Custom Input Modules
  • Writing C/C++ Processors
    • Writing Your Callback Function
    • Write Main
    • Add a Processor Config Stanza to Pipeline
  • Complete C Example
  • Complete C++ Example
  • Using a Bundle with a Module
    • Create the Processor
    • Create the Module
    • Create the Bundle
    • Add an Additional Processor
  • splunk-extplugin.h
• Skins
  • How Splunk Uses Skins
    • Skins css Files
    • images/skins directory
    • static/css directory
  • Add or Remove Themes
    • How To Create a New Skin
    • Examples
  • Re-brand Splunk
    • Examples
  • 2_1skinsHideResults
  • Hide Admin Controls
  • Change Interface Text
• Workflow Integration
  • Live Splunk Integrations to other Apps
    • RSS
    • Shell Script
    • Email
  • Launching Splunk with Permalinks
    • Parameters
    • Unsupported Parameters
    • Example
• Search Language
  • Search language (version 2.1 and 2.2)
  • Syntax
    • Grammar
    • Boolean operators
    • Punctuation
    • Precedence
    • Special characters
  • Operators
    • Boolean Operators
    • Search Operators
    • Time Operators
• Built-In Processors
  • Built-in Processors

Splunk Architecture

Splunk is a high performance, scalable software server written in C/C++ and Python. It indexes and searches logs and other IT data in real time. Splunk works with data generated by any application, server or device. The Splunk Developer API is accessible via SOAP or the command line. After downloading, installing and starting Splunk, you'll find two Splunk Server processes running on your host, splunkd and splunkweb.

• splunkd is a distributed C/C++ server that accesses, processes and indexes streaming IT data and also handles search requests. splunkd processes and indexes your data by streaming it through a series of pipelines, each made up of a series of processors. Pipelines are single threads inside the splunkd process, each configured with a single snippet of XML. Processors are individual, reusable C or C++ functions that act on the stream of IT data passing through a pipeline. Pipelines can pass data to one another via queues. splunkd supports a command line interface for searching and viewing results.

• splunkweb is a Python-based application server providing the Splunk Web user interface. It allows users to search and navigate IT data stored by Splunk servers and to manage your Splunk deployment through the browser interface. splunkweb communicates with your web browser via REST and communicates with splunkd via SOAP.

• Splunk's Data Store manages the original raw data in compressed format as well as the indexes into the data. Data can be deleted or archived based on retention period or maximum data store size.

• Splunk Servers can communicate with one another via **Splunk-2-Splunk*, a TCP-based protocol, to forward data from one server to another and to distribute searches across multiple servers.

• Bundles are files that contain configuration settings including, user accounts, Splunks, Live Splunks, Data Inputs and Processing Properties to easily create specific Splunk environments.

• Modules are files that add new functionality to Splunk by adding to or modifying existing processors and pipelines. They can include C++ code libraries.