Put simply, indexes.conf determines where data is stored on the disk, how much is kept, and for how long. An index is simply a named directory with a specific structure. Inside this directory structure, there are a few metadata files and subdirectories; the subdirectories are called buckets and actually contain the indexed data.
A simple stanza looks like this:
[implSplunk] homePath = $SPLUNK_DB/implSplunk/db coldPath = $SPLUNK_DB/implSplunk/colddb thawedPath = $SPLUNK_DB/implSplunk/thaweddb
Let's walk through these attributes:
- homePath: This is the location for recent data.
- coldPath: This is the location for older data.
- thawedPath: This is a directory where buckets can be restored. It is an unmanaged location. This attribute ...
