Getting Data In

How do Splunk indexers perform indexing without a parser or connector?

rajveeryadav04
New Member

Hi All,

Well, I am new to Splunk, but I have been working on other SIEM tools like RSA SA and QRadar. I just started to learn about Splunk.

Well I want to know about Splunk indexers and how indexing happens here?

Actually I have studied that Splunk doesn't need any parser or connector, so what I am not getting is, if there is no parser, then how is indexing happening? In all other tools, indexing is totally based on a parser. If a parser for a specific device is not available, then all logs from that device will come under unknown device.

Maybe my question looks a bit stupid. Sorry for that, but I really want to know how indexers works and how it identifies devices and applications without any parser for that..

Hope you understand my query, waiting for an answer...

Thanks in advance.

Regards,
Rajbir

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...