After uploading a local log file into Splunk, where does the local data reside?

[splunkrkhanna]

Hi Team,

I've recently downloaded Splunk Enterprise 6.4.4 trial version for Windows 7. I've uploaded a local log file using "Add data" option. After following the wizard the file got uploaded successfully and i can the command as per my need. My question is do you upload my local file to any of the Splunk server or it resides on my local windows machine?

[gokadroid]

Similar to @lukejadamec answer but with index in context:

Let's say you uploaded a data for which your index was called "mysearchindex" and you created a default sourcetype called "mySourceType" in the default app "Search and reporting". Then the raw data that you uploaded, which SPlunk uses can be found in subdirectories here, assuming default path locations which Splunk uses were given while creating "mySearchIndex" :

SplunkHomeDirectory\var\lib\splunk\mysearchindex\db

In general assuming "C:\Program Files\Splunk" is your SplunkHomeDirectory then for every index, raw data file (which has raw data in a slightly "customized" format) can be found in subdirectories here:

C:\Program Files\Splunk\var\lib\splunk\<yourIndexName>\db\

NOTE: The file that you uploaded from local directory will always stay in that local directory untouched. "Splunk's copy" (if you can call it) is as is stated above.

[lukejadamec]

Once the data is added to Splunk it is referred to as Indexed data. The Splunk indexes are stored in Splunk_Home\var\lib\splunk.
The log file you added remains unchanged on the local system.
If you have more than one Splunk server than you can replicate the indexes between them.
Hope that answers your question.