bucket
noun
A directory containing part of a Splunk index. Buckets are particularly important to understand when deploying clusters, planning storage requirements, or developing a retirement and archiving policy.
Splunk indexes typically consist of many buckets, organized by age, which roll through several stages in their transition to retirement and eventual archiving or deletion.
Freshly indexed data starts out in a "hot" bucket that is actively being written to. When the hot database reaches a specified size or age, it becomes a "warm" bucket, and a new hot bucket is created. After some time, the bucket rolls to "cold". Each cold bucket eventually rolls to "frozen", at which point it's either deleted or archived.
Note: The bucket search command has nothing to do with indexing. Rather, it is designed to put continuous numerical values into discrete sets, or buckets. See the Search Reference Manual for more information.
For more information
In the Managing Indexers and Clusters manual:
- How Splunk stores indexes
- Set a retirement and archiving policy
- Basic cluster architecture
- Buckets and clusters