Skip to main content

Interactive Splunk Edge Processing Explorer

See Splunk edge processing in action! Use the interactive explorer below to step through 5 stages of log processing. Watch as raw syslog messages are progressively parsed, filtered, enriched, and prepared for efficient Splunk HEC ingestion.

How to Use This Explorer​

  1. Navigate using arrow keys (← →) or click the numbered stage buttons
  2. Compare the Input (left) and Output (right) JSON at each stage
  3. Observe how fields are added (green highlight) or filtered (removal)
  4. Inspect the YAML code showing exactly what processor was added
  5. Learn from the stage description explaining the technique and business benefit

Interactive Splunk Edge Processing Explorer​

Raw Syslog Data

Unprocessed syslog messages from application servers. In traditional Splunk, ALL of this data gets indexed at $200/TB, including verbose DEBUG messages and noise.

Use ← → arrow keys to navigate
📥Input
2024-01-15 10:30:15 INFO [main] Application started successfully
2024-01-15 10:30:16 DEBUG [worker-1] Initializing connection pool
2024-01-15 10:30:16 DEBUG [worker-1] Pool size: 10, timeout: 30s
2024-01-15 10:30:17 WARN [auth] Failed login attempt: user=admin ip=192.168.1.100
2024-01-15 10:30:18 ERROR [db] Connection timeout to database server
2024-01-15 10:30:19 DEBUG [health] Health check passed - all services OK
📤Output
2024-01-15 10:30:15 INFO [main] Application started successfully
2024-01-15 10:30:16 DEBUG [worker-1] Initializing connection pool
2024-01-15 10:30:16 DEBUG [worker-1] Pool size: 10, timeout: 30s
2024-01-15 10:30:17 WARN [auth] Failed login attempt: user=admin ip=192.168.1.100
2024-01-15 10:30:18 ERROR [db] Connection timeout to database server
2024-01-15 10:30:19 DEBUG [health] Health check passed - all services OK
Added/Changed
Removed
Completed Step
Current Step
Not Done Yet
📄New Pipeline Stepsplunk-input.yaml
input:
  file:
    paths: [ "/var/log/app/*.log" ]
    multiline:
      pattern: '^\d{4}-\d{2}-\d{2}'
      negate: true
      match: after

Try It Yourself​

Ready to build this Splunk edge processing pipeline? Follow the step-by-step tutorial:

Deep Dive into Each Step​

Want to understand each transformation in depth?

Next: Set up your environment to build this pipeline yourself