Buckets
You may have noticed that there is a certain pattern in this configuration file, in which folders are broken into three locations: coldPath, homePath, and thawedPath. This is a very important concept in Splunk. An index contains compressed raw data and associated index files that can be spread out into age-designated directories. Each piece of this index directory is called a bucket.
A bucket moves through several stages as it ages. In general, as your data gets older (think colder) in the system, it is pushed to the next bucket. And, as you can see in the following list, the thawed bucket contains data that has been resurrected from an archive. Here is a breakdown of the buckets in relation to each other:
hot: This is newly indexed data and open for writing (
hotPath)warm: This is data rolled from hot with no active writing (
warmPath)cold: This is data rolled from warm (
coldPath)frozen: This is data rolled from cold and deleted by default but it can be archived (
frozenPath)thawed:...
