Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Splunk Essentials

You're reading from   Splunk Essentials Operational Intelligence at your fingertips

Arrow left icon
Product type Paperback
Published in Sep 2016
Publisher
ISBN-13 9781785889462
Length 236 pages
Edition 2nd Edition
Tools
Arrow right icon
Authors (3):
Arrow left icon
Somesh Soni Somesh Soni
Author Profile Icon Somesh Soni
Somesh Soni
Betsy Page Sigman Betsy Page Sigman
Author Profile Icon Betsy Page Sigman
Betsy Page Sigman
Erickson Delgado Erickson Delgado
Author Profile Icon Erickson Delgado
Erickson Delgado
Arrow right icon
View More author details
Toc

Table of Contents (10) Chapters Close

Preface 1. Splunk in Action FREE CHAPTER 2. Bringing in Data 3. Search Processing Language 4. Data Models and Pivot 5. Data Optimization, Reports, Alerts, and Accelerating Searches 6. Panes of Glass 7. Splunk SDK for JavaScript and D3.js 8. HTTP Event Collector 9. Best Practices and Advanced Queries

Buckets

You may have noticed that there is a certain pattern in this configuration file, in which folders are broken into three locations: coldPath, homePath, and thawedPath. This is a very important concept in Splunk. An index contains compressed raw data and associated index files that can be spread out into age-designated directories. Each piece of this index directory is called a bucket.

A bucket moves through several stages as it ages. In general, as your data gets older (think colder) in the system, it is pushed to the next bucket. And, as you can see in the following list, the thawed bucket contains data that has been resurrected from an archive. Here is a breakdown of the buckets in relation to each other:

  • hot: This is newly indexed data and open for writing (hotPath)
  • warm: This is data rolled from hot with no active writing (warmPath)
  • cold: This is data rolled from warm (coldPath)
  • frozen: This is data rolled from cold and deleted by default but it can be archived (frozenPath)
  • thawed...
lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Banner background image