topic Re: Indexed data in Splunk Enterprise

Indexed data

AliMaher — Sun, 16 Jun 2024 23:46:19 GMT

Hi,

I want to ask where i can find the indexed data stored as per the below, i found the bucket consist of the RAW data, index file and some meta data :

Re: Indexed data

deepakc — Mon, 17 Jun 2024 07:36:40 GMT

The index data lives on the Splunk indexer Server's . You typically use a Splunk Universal Forwarder or Heavy forwarder or some other means to send data to the Indexers and they get stored into a bucket(folder).

So login to your Splunk indexers and go to the storage volume and see the data there. See the table section "What the index directories look like" this will show you the paths

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/HowSplunkstoresindexes

Re: Indexed data

glc_slash_it — Mon, 17 Jun 2024 07:37:39 GMT

Check this path in Indexer's filesystem:

/opt/splunk/var/lib/splunk/<any_index>/db

Re: Indexed data

AliMaher — Mon, 17 Jun 2024 12:06:13 GMT

Great!

Thanks for your help, i had checked the article, but each bucket consist of raw data and tsidx file only.

i am asking after the raw data is parsed and normalized, should they stored in somewhere in the parsed form.