Splunk Cloud Platform

Where does data go in Splunk Cloud?

New Member


My question is: When I send logs into the Splunk Cloud platform, where exactly do they go? Are they also stored in buckets on an indexer, and if so, how many indexers?

Labels (1)
0 Karma


Yes, Splunk Cloud stores data in indexers, just like an on-prem Splunk server.  The biggest difference is Splunk Cloud uses SmartStore for storing warm buckets.  The exact number of indexers varies for each customer and typically is not shared.  You can use this query to see the indexers you have: | tstats count where index=_internal by splunk_server

If this reply helps you, Karma would be appreciated.
0 Karma



Based on which kind of cloud you have (e.g. gov / normal SC)  those are going to some AWS regions. On those regions there are separate environments for every customer. Data is stored as onside to buckets on indexers. The amount of indexers is depending on your environment size (how much you are ingesting or how many SVC you have bought).

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...