Edge Processor provides customers new abilities to filter and mask, and otherwise transform their data, before routing it to supported destinations. Edge Processor joins Ingest Actions as part of Splunk’s pre-ingest data transformation capabilities.
With Edge processing, you can also discard the data or store data in AWS S3 based on search and preparation language, SPL2. With SPL2, customers have much more flexibility to shape data so that it is formatted exactly how they want before sending it to be indexed.
Ingest actions allow you to quickly author, preview, and deploy transformation rules at ingest time, through an intuitive user interface. These rulesets allow you to define one or more rules with a few clicks, allowing you to mask, truncate, route, or eliminate data without having to access the command line or hand write stanzas in configuration files.
Federated search provides the capability to execute a unified search across multiple Splunk environments (including Splunk Cloud and On-premise) providing a true federated search experience.