Getting Data In

Do splunked events, that are gzip'd on disk, stay that way while I am searching them?

maverick
Splunk Employee
Splunk Employee

Suppose I splunk a file and it is gzip'd on disk under the appropriate Splunk index directory.

Then let's say I conduct a search for some of those splunked events.

Will splunk read the events directly out of the gzip file into memory, or will it expand out the gzip file somewhere else first and THEN read them? If so, where on disk is expansion taking place?

Also, once Splunk reads the events from the gzip'd splunk file, does it write or cache any or all of those events out to disk temporarily and, if so, where and how long do those artifact stay around?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The index directory is not changed. The contents are extracted in memory. As usual, search results are stored in $SPLUNK_HOME/var/run/splunk/dispatch/

Additionally, as of version 4.1.2, unzipped results are not cached, but are re-extracted from the index each time as needed.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The index directory is not changed. The contents are extracted in memory. As usual, search results are stored in $SPLUNK_HOME/var/run/splunk/dispatch/

Additionally, as of version 4.1.2, unzipped results are not cached, but are re-extracted from the index each time as needed.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...