Managing Splunk Indexes

Indexes are where the data that is sent to Splunk is stored. Each index is a directory, and as we discussed in previous sections, each directory contains a subdirectory for host/warm buckets (in /db), cold buckets (in /colddb), and a datamodel_summary , and thaweddb directory, which may be empty if not used for datamodels and thawed buckets, respectively. The folder structure for Splunk's _internal index looks like this:

/opt/splunk/var/lib/splunk/_internaldb
   /colddb
   /datamodel_summary
   /db
   /thaweddb

Index buckets are the files and directories inside each of the above; for example, the /db directory will contain directories of both hot buckets (open and being written to, usually named hot_xxx), and warm buckets (closed for writing, but quickly searchable, usually named db_xxx or rb_xxx). The db_xxx buckets are those that were created on this...