Skip to content OpenLabs

Splunk Visual Handbook phase 3 · Where it lands

A bucket is a directory that ages

An index is not a database. It is a set of directories, each covering a slice of time, that move through four states on their way out — and how far back you can search is what is left over from your daily volume and four limits, a number that appears in no configuration file.

Primary sources

Cited above by name. Where a source has no link it is because none is stable enough to print — the citation is what you search for.

  1. Splunk Inc. (current). How the indexer stores indexes. Splunk Enterprise documentation.

    What a bucket is made of, and the sentence that makes the rest of the model make sense: buckets are sets of directories organised by age, each covering a limited time range.

  2. Splunk Inc. (current). Configure index storage. Splunk Enterprise documentation.

    The four settings, their defaults, and which transition each one governs. Worth reading as a table of four different units — megabytes, a count, megabytes again, and seconds — because that mismatch is where the mistakes come from.

  3. Splunk Inc. (current). Set a retirement and archiving policy. Splunk Enterprise documentation.

    The page that should be read before anybody promises a retention period. It states that either limit freezes data, that the size limit can get there first, and what freezing does to the data if you did not configure an archive.

  4. Splunk Inc. (current). Restore archived indexed data. Splunk Enterprise documentation.

    What an archived bucket contains, which is less than you might assume: only the raw data directory. The searchable part is rebuilt on restore, which is why the archive is small and why restoring is work.