Deployment Architecture

Indexed data

aoliullah
Path Finder

Hi. I am just confused a bit with raw and indexed/indexing data being stored by the index. So does the index store both raw data in compressed format and also the raw data as broken down events? Does it take up multiple storage?

Tags (1)
0 Karma

renems
Communicator

Hi,

to be really short: your data will be stored as raw, compressed data. Tsidx files is a sort of index file on your raw data (per bucket), created by splunk itself. It allows splunk a fast way to find the buckets needed to decompress, when you search your data.

A far more detailed explaination, can be found here: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/HowSplunkstoresindexes

0 Karma

aoliullah
Path Finder

Hi. I got confused with the following statement to be precise -

"A bucket is a directory containing a set of rawdata plus indexing data."

Could you clarify what the "rawdata" and the "indexing data" is meant here?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...