topic Re: Indexed data in Deployment Architecture

Indexed data

aoliullah — Fri, 27 Jan 2017 11:49:19 GMT

Hi. I am just confused a bit with raw and indexed/indexing data being stored by the index. So does the index store both raw data in compressed format and also the raw data as broken down events? Does it take up multiple storage?

Re: Indexed data

renems — Fri, 27 Jan 2017 12:50:56 GMT

Hi,

to be really short: your data will be stored as raw, compressed data. Tsidx files is a sort of index file on your raw data (per bucket), created by splunk itself. It allows splunk a fast way to find the buckets needed to decompress, when you search your data.

A far more detailed explaination, can be found here: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/HowSplunkstoresindexes

Re: Indexed data

aoliullah — Fri, 27 Jan 2017 14:13:27 GMT

Hi. I got confused with the following statement to be precise -

"A bucket is a directory containing a set of rawdata plus indexing data."

Could you clarify what the "rawdata" and the "indexing data" is meant here?