where is data stored if we are using APP on search head

[saifuddin9122]

Hello All

i have a doubt regarding the data storage. i am clear that my data is stored on INDEXERS in buckets. if i am using a APP on my search head in this case where will be my data stored which will be available for later searches.

[gfuente · Accepted solution]

Hello

The Indexed data is always stored in the indexers. Usually the apps has a part for the SH (with dashoards, fields extractions, eventypes...). And there is another part of the app for the indexers (with the parsing options, props.conf). Depending on the app it should be distributed in a way or another. If you have doubts deploy the same app in the SH and IDX. But in any case, the data always will be on the indexers

regards

[saifuddin9122]

Thanks for quick response.

so as per your answer i came to conclusion that all the data is stored on indexers even the app is installed on SEARCH HEAD. am i correct??

[gfuente]

Yes, you are correct (there are some data, like lookups and KV Store data, that lives on the SH, but indexed data always on the indexers)