What does Splunk do when it indexes events?

Question

Options

• AExtracts the top 10 fields.
• BExtracts metadata fields such as host, source, sourcetype.
• CPerforms parsing, merging, and typing processes on universal forwarders.
• DCreate report acceleration summaries.

• A
  2% (1)
• B
  93% (52)
• C
  2% (1)
• D
  4% (2)

Explanation

When Splunk indexes events, it automatically extracts metadata fields - host, source, and sourcetype - along with internal fields like _time and _raw, which are stored with every event and used to organize and search data efficiently. Option A is wrong because Splunk does not limit field extraction to a fixed "top 10" at index time; field extraction is configurable and happens primarily at search time via props.conf. Option C is wrong because parsing, merging, and typing occur on the indexer (or heavy forwarder), not the universal forwarder, which only forwards raw data. Option D is wrong because report acceleration summaries are generated on-demand or on a schedule as a search-time optimization, not during indexing.

Memory tip: Think of indexing as "stamping" each event with its identity card - where it came from (host, source) and what kind of data it is (sourcetype). Everything else is figured out later at search time.

No community discussion yet for this question.