https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483310#M193325 <P>Thank you very much David <BR /> it's very helpfull ! </P> Wed, 15 Jan 2020 14:58:34 GMT aalaa 2020-01-15T14:58:34Z https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483305#M193320 <P>Hello community , </P> <P>I would like to know where splunk db connect stored data ? </P> Wed, 15 Jan 2020 10:30:19 GMT https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483305#M193320 aalaa 2020-01-15T10:30:19Z https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483306#M193321 <P>Sorry, but your question is not clear to me. Do you mean where does the Splunk DB Connect stores it's data that is being queried from a database table? Or where does the Splunk DB Connect saves it's config files. Please clarify. </P> Wed, 15 Jan 2020 12:50:28 GMT https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483306#M193321 PvandenHondel 2020-01-15T12:50:28Z https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483307#M193322 <P>Hi @aalaa,</P> <P>DBconnect doesn't store any data. It allows you to create a connection with Data Bases and collect the data from there or use the DB as a lookup.</P> <P>If you have a DB input setup, the all you have to do is look for the index where it's writing the data and you'll have everything there. If there is no DB input created then you're not indexing data at all and it's all still on your data base or in some lookup file.</P> <P>Cheers,<BR /> David</P> Wed, 15 Jan 2020 13:05:29 GMT https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483307#M193322 DavidHourani 2020-01-15T13:05:29Z https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483308#M193323 <P>Thank you David , and what about the other data ? how splunk store it ? <BR /> I would like to know how splunk store data </P> Wed, 15 Jan 2020 13:31:03 GMT https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483308#M193323 aalaa 2020-01-15T13:31:03Z https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483309#M193324 <P>You're welcome @aalaa.</P> <P>This document explains how Splunk stores data, what the index structure is and what the buckets inside an index are: <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Indexer/HowSplunkstoresindexes">https://docs.splunk.com/Documentation/Splunk/latest/Indexer/HowSplunkstoresindexes</A></P> <P>All your indexed data is stored on your indexers and the structure of each data index is as the one you'll see described in the link above.</P> <P>Let me know if that helps and if there's anything I missed.</P> Wed, 15 Jan 2020 13:53:49 GMT https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483309#M193324 DavidHourani 2020-01-15T13:53:49Z https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483310#M193325 <P>Thank you very much David <BR /> it's very helpfull ! </P> Wed, 15 Jan 2020 14:58:34 GMT https://community.splunk.com/t5/Splunk-Search/splunk-db-connect/m-p/483310#M193325 aalaa 2020-01-15T14:58:34Z