Generally indexer is used to store indexes but in the standalone architecture how data is stored ???
The splunk instance with the indexer role is storing data.
In a standalone architecture the single server is perfoming all the roles.
The splunk instance with the indexer role is storing data.
In a standalone architecture the single server is perfoming all the roles.
As already said, normally events are stored into indexes which are in same server than search head on all-in-one server case. In distributed environments those are in different servers. Then there are lookups and kvstore files, which are always stored on search head side.
r. Ismo
Standalone works as all in one server and it stores data too..