OpenLabs handbook
Splunk Visual Handbook
Four phases, and the only question that matters is which machine runs each one.
Splunk is a pipeline before it is a search bar. A forwarder that does not parse, a parsing phase that happens exactly once, a bucket that ages on disk, and a search that is split between two tiers. Every model here runs, and the numbers come out of the run.
Roadmap
The order in which the concepts hold each other up. The interactive map is not drawn yet — drawing the path before walking it would be a promise, so the phases are listed plainly instead.
- 01 Where the data comes in Inputs, forwarders, and what a universal forwarder actually sends.
- 02 Where a byte stream becomes events Parsing happens once, on the first component that can do it.
- 03 Where it lands An index is directories that age: hot, warm, cold, frozen.
- 04 What the search can read What was decided at index time, and what is still negotiable.
- 05 When one machine is not enough Load balancing, replication, and the two factors that are not the same promise.
- 06 Who owns the configuration Deployment apps, layering, and why the same file wins in two different places.
Articles and labs
Each phase pairs prose with a model. The article says what is true; the lab is the thing running, and you can break it.
01 Where the data comes in
Inputs, forwarders, and what a universal forwarder actually sends.
Articles
- A universal forwarder does not parse ready
- An input is a promise about metadata coming
Labs
02 Where a byte stream becomes events
Parsing happens once, on the first component that can do it.
Articles
Labs
03 Where it lands
An index is directories that age: hot, warm, cold, frozen.
Articles
Labs
04 What the search can read
What was decided at index time, and what is still negotiable.
Articles
- Index time is the decision you cannot take back coming
- The search head delegates what it can coming
Labs
- What runs on the indexer, and what comes up to the search head coming
05 When one machine is not enough
Load balancing, replication, and the two factors that are not the same promise.
Articles
- Replication is durability; search factor is patience coming
Labs
- A peer dies, and the two factors answer differently coming
06 Who owns the configuration
Deployment apps, layering, and why the same file wins in two different places.
Articles
- The deployment server does not push coming
Labs
- The same setting, in four files coming
Handbook assessment
The cumulative assessment has not been authored yet. Available labs and articles remain open for study.