Licensing, Indexing, and Buckets
The previous chapters showed us how to get data into Splunk and how to use Splunk query language to gain insight into the data and create visualizations that can be used to solve problems. In this chapter, we begin the exploration of how Splunk stores data. Splunk stores data in data structures called buckets. A collection of buckets is called an index. The process of storing incoming data into buckets is called indexing. Data passes through a series of queues and pipelines. The result is individual events that are stored physically on disk. Splunk organizes buckets and indexes on a filesystem in the form of raw data and index files. Splunk keeps track of the volume of incoming data using license models. We will look at various free and paid license models in Splunk.
In this chapter, we will explore the following topics:
- Understanding Splunk indexing and buckets
- Exploring Splunk queues
- Discussing Splunk licensing models