Mastering Splunk

Location, location, location

You might think that the question whether your data is local or remote is straightforward, but with Splunk, there are a few principles that will determine the answer. These include the following:

• The operating system on which Splunk is installed
• The kind of data that is directly connected to Splunk
• Whether any authentication or other intermediate steps are needed to access the data that you want Splunk to index
• The distance and size of the data being monitored

This is represented in the following diagram:

Generally speaking, if there are no intermediate steps between the data and Splunk, it's considered local. Examples of ...