Which location/path is stored the splunk data using universal forwarder?

[05500]

If we forward data using universal forwarder from each servers to splunk server,

Q1, Which location/path is stored the forwarded data (original event log data / not indexed data)?
Q2, Which location/path is stored the indexed data?

[esix_splunk]

For your questions..

On the UF, data is stored in $splunk_home$/var/run/* until its forwarded to the indexer layer.

On the Indexer, this is typically stored in $splunk_home$/var/lib/splunk/. However, that is configurable and can be placed anywhere on the file system that you choose.

[05500]

Once the forwarded data is moved/indexed from $splunk_home$/var/run/* to $splunk_home$/var/lib/splunk/,
This move is automatically?

[esix_splunk]

Forwarders forward data to indexers. If you're running an all in one instance, then there is no UF involved. You are ingested the data and its being written to the indexes in $splunk_home$/var/lib/splunk/*.

For UFs, they delete the queued data after it is forwarded.

[05500]

On the UF, data is stored in $splunk_home$/var/run/* until its forwarded to the indexer layer.

-> If it forwarded to the indexer layer, does data delete on $splunk_home$/var/run/* ?

[esix_splunk]

Once a forwarder ingests and forwards the data, nothing is stored locallly on the UF in Splunk.

If you are ingesting syslog or other files, those will still be on the filesystem, but thats outside of Splunk.