Explain how Splunk works? Briefly explain the Splunk Architecture.

Splunk is a platform allowing people to get more reach into machine data, through various technological sources like hardware, servers, IoT enabled devices and others.

Splunk functions as three main functions, i.e. Forwarder, Indexer and Search Head. The Forwarder is acting as a data collection agent and forward the data onto the Indexer. Now, this will store data locally in a hardware host machine or on data clouds. Finally, Search Head is used for searching, visualizing, analyzing, and also performing various other functions on the data stored.