Parsing phase settings
Going through the parsing phase is crucial before data is indexed. Parsing happens right after the input phase – the process is input -> parsing -> indexing, in this order. You can refer to the Data indexing phases section of Chapter 8, which introduced these phases, for a refresher. The data stream must be preprocessed before indexing. The parsing phase in Splunk is necessary for formatting and extracting relevant data from unstructured or semi-structured input, making the data searchable and actionable. The following are some of the important sub-phases that data goes through:
- Breaking the whole data stream into individual events
- Identifying the timestamp of an event if needed and applying it
- Applying metadata fields such as the host, sourcetype, source, and index
- Optionally transforming the data by re-routing, overriding metadata, masking portions of events, filtering and dropping unnecessary events, and so on
These...
