Explore Splunk Edge Processing

How to use this explorer

Move between stages with the arrows or the numbered stage list. Each stage shows the input it receives on the left and the output it produces on the right, with the lines that changed marked. The configuration that makes the change sits below the comparison, and the final stage shows the complete pipeline.

The 5 stages in order

1. Authored log fixture
   Inspect the synthetic application lines before any parse or retention policy is applied.
2. Parse selected fields
   Map the narrow fixture format into timestamp, level, thread, message, and raw fields.
3. Apply a retention policy
   Delete the fixture records selected by this authored policy. Real retention rules require security, audit, and investigation review.
4. Add HEC metadata
   Wrap each retained event and add authored source, host, sourcetype, and index values.
5. Route to Splunk HEC
   Configure an external HEC endpoint, token header, and example batch policy. Delivery has not been exercised.

Interactive pipeline

SPLUNK HEC REFERENCE

Curated log-processing states

Stage1. Authored log fixture2. Parse selected fields3. Apply a retention policy4. Add HEC metadata5. Route to Splunk HEC

Stage 1 of 5

Authored log fixture

Inspect the synthetic application lines before any parse or retention policy is applied.

0HighlightsAuthored emphasis only—not a computed diff.

Highlights only

Copy & download

Input

 2024-01-15 10:30:15 INFO  [main] Application started successfully 2024-01-15 10:30:16 DEBUG [worker-1] Initializing connection pool 2024-01-15 10:30:16 DEBUG [worker-1] Pool size: 10, timeout: 30s 2024-01-15 10:30:17 WARN  [auth] Failed login attempt: user=admin ip=192.168.1.100 2024-01-15 10:30:18 ERROR [db] Connection timeout to database server 2024-01-15 10:30:19 DEBUG [health] Health check passed - all services OK

Output

 2024-01-15 10:30:15 INFO  [main] Application started successfully 2024-01-15 10:30:16 DEBUG [worker-1] Initializing connection pool 2024-01-15 10:30:16 DEBUG [worker-1] Pool size: 10, timeout: 30s 2024-01-15 10:30:17 WARN  [auth] Failed login attempt: user=admin ip=192.168.1.100 2024-01-15 10:30:18 ERROR [db] Connection timeout to database server 2024-01-15 10:30:19 DEBUG [health] Health check passed - all services OK

Partial snippet01-authored-log-fixture.yaml

input:
  file:
    paths:
      - /var/log/app/*.log