Deployment Architecture

What is the difference between rb bucket and db bucket?

aalhabbash1
Path Finder

Hi Splunker;

What is the difference between rb_* and db_* under splunk_cold and splunk_hot directory storage? you can see the example below.

rb_1564000917_1563984040_7538_0B51C6C4-28F7-4348-A8F4-51FD8D156178
db_1562576411_1562565181_7654_B0AF5CBE-9B45-46D7-B374-E398083AFE9E

And can I remove the rb bucket or not?

Regards

toney_mu
New Member
.db Files: The .db files in the frozen directory are SQLite database files. These files store the indexed and compressed data in a structured format for efficient retrieval. Splunk uses SQLite as a lightweight embedded database engine for managing and organizing indexed data. .rb Files: The .rb files are Splunk's "Rolling Bloom Filter" files. They are part of the Splunk indexing process and contain metadata used for efficient searching and filtering of data. The Rolling Bloom Filter is a probabilistic data structure that helps to quickly determine if a particular term or value is likely to exist in an index block, reducing the need for expensive disk I/O operations during searches.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Buckets starting with "rb_" are replicated buckets - copies of buckets from other indexers in the cluster.
Do not delete them. If you do, Splunk will just re-create them.
Don't bother backing them up, either. You'll just waste backup time and storage. Splunk will re-create the rb buckets after the backup is restored.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...