As @maciep said, the definitions are under indexes.conf
By default we have -
[hatch]
homePath = $SPLUNK_DB/hatchdb/db
coldPath = $SPLUNK_DB/hatchdb/colddb
thawedPath = $SPLUNK_DB/hatchdb/thaweddb
maxDataSize = 10000
maxHotBuckets = 10
For each index, a colddb directory exists under the index main directory.
... View more