Slice Splunk simpler and faster with better metadata
Splunk is a powerful event log indexing and search tool that lets you analyze large amounts of data. Event and log streams can be fed to the Splunk engine where they are scanned and indexed. Splunk supports full text search plus highly optimized searches against metadata and extracted data fields. Extracted fields are outside this scope of this missive. Each log/event record consists of the log/event data itself and information about the log/event known as metadata. For example, Splunk knows the originating host for each log/event. Queries can efficiently filter by full or partial host names without having to specifically put the host name in every log message. Message counts with metadata wildcards One of the power features of metadata is that Splunk will provide a list of all metadata values and the number of matching messages as part of the result of any query. A Splunk query returns matching log/event records and the the number of records in e...