Since Splunk does not have a central database, how does it hold historical data?

[aracnacon]

We currently use SCOM for Hostorical Data and we are considering using Splunk. Since Splunk does not have a central database how does it hold Historical Data, such as a years worth of data?

[martin_mueller · Accepted solution]

Splunk holds its data in a proprietary file "database", structured smartly for efficient searches. In larger deployments, Splunk scales horizontally with many Splunk Indexer instances, each holding a fraction of the data (and potentially replicated copies...).

Here's one way of approaching the docs to understand scaling Splunk for lots of data: http://docs.splunk.com/Documentation/Splunk/6.2.4/Deploy/Distributedoverview