Splunk Structure

The Splunk infrastructure is made up of various components

Indexer – processes incoming machine data and stores the results in indexes for searching. Raw data is compressed and indexes point to the data

Search Head – takes the search request and distributes it to the indexes which search the data, then consolidates the results and displays them. Knowledge objects on the search head can be used to create additional fields and transform the data

Forwarder – consume data and forwards it to the indexers for processing

Deployment Server - distributes content and configurations

Cluster Master -  coordinates the replicating activities of the peer nodes and tells the search head where to find data

License Master – shares licenses with other nodes

The Folder Structure

The structure of the folders within Splunk is as follows: