Splunk

Indexers, forwarders and search heads, SPL, Observability Cloud, and alerting

Splunk is built around three roles — forwarders collect, indexers store and index, search heads query — and most architecture questions are really about how those scale and where the bottleneck sits. The schema-on-read model is the concept interviewers probe hardest: Splunk does not force structure at ingest, so the same raw event can be parsed differently by different searches. That flexibility is why Splunk suits security and forensic work, and why poorly written searches get expensive. Expect questions on SPL — the pipe model, the difference between streaming and transforming commands, and why moving a filter earlier in the pipeline matters more than any other optimisation. Index-time versus search-time field extraction, summary indexing for expensive recurring reports, and the licensing model based on daily ingest volume are all common ground.