Deployment Architecture

What is the difference between rb bucket and db bucket?

aalhabbash1
Path Finder

Hi Splunker;

What is the difference between rb_* and db_* under splunk_cold and splunk_hot directory storage? you can see the example below.

rb_1564000917_1563984040_7538_0B51C6C4-28F7-4348-A8F4-51FD8D156178
db_1562576411_1562565181_7654_B0AF5CBE-9B45-46D7-B374-E398083AFE9E

And can I remove the rb bucket or not?

Regards

toney_mu
New Member
.db Files: The .db files in the frozen directory are SQLite database files. These files store the indexed and compressed data in a structured format for efficient retrieval. Splunk uses SQLite as a lightweight embedded database engine for managing and organizing indexed data. .rb Files: The .rb files are Splunk's "Rolling Bloom Filter" files. They are part of the Splunk indexing process and contain metadata used for efficient searching and filtering of data. The Rolling Bloom Filter is a probabilistic data structure that helps to quickly determine if a particular term or value is likely to exist in an index block, reducing the need for expensive disk I/O operations during searches.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Buckets starting with "rb_" are replicated buckets - copies of buckets from other indexers in the cluster.
Do not delete them. If you do, Splunk will just re-create them.
Don't bother backing them up, either. You'll just waste backup time and storage. Splunk will re-create the rb buckets after the backup is restored.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...