bucket
noun
A directory containing a portion of a single Splunk index. Buckets are important to understand when developing a retirement and archiving policy.
Splunk indexes consist of multiple, aging buckets, which roll through several stages in their transition to retirement and eventual archiving or deletion.
Freshly indexed data starts out in a "hot" database, in a directory that is actively being written to. When the hot database reaches a specified size or age, it becomes a bucket in a searchable "warm" database, and a new hot database is created. A warm database by default contains a maximum of 300 buckets, after which the buckets begin to roll to "cold". Cold databases also have a default maximum of 300 buckets, after which the cold buckets begin to roll to "frozen". When a Splunk bucket attains the status of "frozen", it's eligible for deletion or archiving.
Note: The bucket search command has nothing to do with indexing. Rather, it is designed to put continuous numerical values into discrete sets, or buckets. See the Search Reference Manual for more information.
For more information
In the Admin manual: