What is a Splunk index?

As mentioned on http://www.splunk.com, a Splunk index can be defined as follows:

"A Splunk index is a repository for Splunk data."

Data that has not been previously added to Splunk is referred to as raw data. When the data is added to Splunk, it indexes the data (uses the data to update its indexes), creating event data. Individual units of this data are called events. In addition to events, Splunk also stores information related to Splunk's structure and processing (all this stuff is not event data), transforming the data into its searchable events.

Splunk stores the data it indexed and its indexes within flat files (actually, files in a structured directory), meaning that it doesn't require any database software running in the background. These files are called indexers. Splunk can index any type of time series data (data with timestamps). During data indexing, Splunk breaks data into events based on the timestamps it identifies.

Event processing

Splunk event processing...