Indexes are where Splunk Enterprise stores all the data it has processed. It is essentially a collection of databases that is, by default, located at $SPLUNK_HOME/var/lib/splunk. Before data can be searched, it needs to be indexed, a process we describe here.
There are two ways to create an index, through the Splunk portal or by creating an indexes.conf file. You will be shown here how to create an index using the Splunk portal, but you should realize that when you do that, it simply generates an indexes.conf file.
You will be creating an index called wineventlogs to store Windows Event Logs. To do this, take the following steps:
In the Splunk navigation bar, go to Settings.
In the Data section, click on Indexes, which will take you to the Indexes page.
Click on New Index.
Now fill out the information for this new index as seen in the following screenshot, carefully going through steps 1 to 4.
Be sure to Save when you are done.
You will now see the new index in the list as shown...