What is the difference between rb bucket and db bucket?

[aalhabbash1]

Hi Splunker;

What is the difference between rb_* and db_* under splunk_cold and splunk_hot directory storage? you can see the example below.

rb_1564000917_1563984040_7538_0B51C6C4-28F7-4348-A8F4-51FD8D156178
db_1562576411_1562565181_7654_B0AF5CBE-9B45-46D7-B374-E398083AFE9E

And can I remove the rb bucket or not?

Regards

[toney_mu]

.db Files: The .db files in the frozen directory are SQLite database files. These files store the indexed and compressed data in a structured format for efficient retrieval. Splunk uses SQLite as a lightweight embedded database engine for managing and organizing indexed data. .rb Files: The .rb files are Splunk's "Rolling Bloom Filter" files. They are part of the Splunk indexing process and contain metadata used for efficient searching and filtering of data. The Rolling Bloom Filter is a probabilistic data structure that helps to quickly determine if a particular term or value is likely to exist in an index block, reducing the need for expensive disk I/O operations during searches.

[richgalloway]

Buckets starting with "rb_" are replicated buckets - copies of buckets from other indexers in the cluster.
Do not delete them. If you do, Splunk will just re-create them.
Don't bother backing them up, either. You'll just waste backup time and storage. Splunk will re-create the rb buckets after the backup is restored.