Using the Query Federated Search App for Splunk
January 10, 2024
With Query, data does not need to be ingested or stored in Splunk to be used in Splunk. Query is a bridge between Splunk and your data, wherever it is stored, making more data accessible and actionable within your Splunk instance. With Federated Search and in-flight data normalization, Query can add additional data to your Splunk reports and rule sets seamlessly.