Do splunked events, that are gzip'd on disk, stay that way while I am searching them?

[maverick]

Suppose I splunk a file and it is gzip'd on disk under the appropriate Splunk index directory.

Then let's say I conduct a search for some of those splunked events.

Will splunk read the events directly out of the gzip file into memory, or will it expand out the gzip file somewhere else first and THEN read them? If so, where on disk is expansion taking place?

Also, once Splunk reads the events from the gzip'd splunk file, does it write or cache any or all of those events out to disk temporarily and, if so, where and how long do those artifact stay around?

[gkanapathy · Accepted solution]

The index directory is not changed. The contents are extracted in memory. As usual, search results are stored in $SPLUNK_HOME/var/run/splunk/dispatch/

Additionally, as of version 4.1.2, unzipped results are not cached, but are re-extracted from the index each time as needed.