Indexed data

[aoliullah]

Hi. I am just confused a bit with raw and indexed/indexing data being stored by the index. So does the index store both raw data in compressed format and also the raw data as broken down events? Does it take up multiple storage?

[renems]

Hi,

to be really short: your data will be stored as raw, compressed data. Tsidx files is a sort of index file on your raw data (per bucket), created by splunk itself. It allows splunk a fast way to find the buckets needed to decompress, when you search your data.

A far more detailed explaination, can be found here: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/HowSplunkstoresindexes

[aoliullah]

Hi. I got confused with the following statement to be precise -

"A bucket is a directory containing a set of rawdata plus indexing data."

Could you clarify what the "rawdata" and the "indexing data" is meant here?