https://community.splunk.com/t5/Splunk-Search/Input-data-saved-where/m-p/75908#M181426 <P>By default, Splunk will save it's data in the default 'main' index, which normally is located in the /opt/splunk/var/lib/defaultdb directory structure.</P> <P>/k</P> Thu, 14 Jun 2012 20:29:31 GMT kristian_kolb 2012-06-14T20:29:31Z https://community.splunk.com/t5/Splunk-Search/Input-data-saved-where/m-p/75907#M181425 <P>Hi there.<BR /> Splunk Linux version. On which directory are the logs, that come from another server through UDP, or from the same server, <STRONG>saved</STRONG>?</P> <P>Thanks!</P> Thu, 14 Jun 2012 20:22:23 GMT https://community.splunk.com/t5/Splunk-Search/Input-data-saved-where/m-p/75907#M181425 gera83 2012-06-14T20:22:23Z https://community.splunk.com/t5/Splunk-Search/Input-data-saved-where/m-p/75908#M181426 <P>By default, Splunk will save it's data in the default 'main' index, which normally is located in the /opt/splunk/var/lib/defaultdb directory structure.</P> <P>/k</P> Thu, 14 Jun 2012 20:29:31 GMT https://community.splunk.com/t5/Splunk-Search/Input-data-saved-where/m-p/75908#M181426 kristian_kolb 2012-06-14T20:29:31Z https://community.splunk.com/t5/Splunk-Search/Input-data-saved-where/m-p/75909#M181427 <P>The logs are saved in Splunk's index, or "database" if you will. File system-wise, an index is distributed across a number of files, by default in <CODE>$SPLUNK_HOME/var/lib</CODE>. These files are in a proprietary format that cannot (easily) be used for reading directly.</P> <P>More information on Splunk indexes: <A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/WhatsaSplunkindex">http://docs.splunk.com/Documentation/Splunk/latest/admin/WhatsaSplunkindex</A></P> Thu, 14 Jun 2012 20:34:07 GMT https://community.splunk.com/t5/Splunk-Search/Input-data-saved-where/m-p/75909#M181427 Ayn 2012-06-14T20:34:07Z