Getting Data In

Do splunked events, that are gzip'd on disk, stay that way while I am searching them?

maverick
Splunk Employee
Splunk Employee

Suppose I splunk a file and it is gzip'd on disk under the appropriate Splunk index directory.

Then let's say I conduct a search for some of those splunked events.

Will splunk read the events directly out of the gzip file into memory, or will it expand out the gzip file somewhere else first and THEN read them? If so, where on disk is expansion taking place?

Also, once Splunk reads the events from the gzip'd splunk file, does it write or cache any or all of those events out to disk temporarily and, if so, where and how long do those artifact stay around?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The index directory is not changed. The contents are extracted in memory. As usual, search results are stored in $SPLUNK_HOME/var/run/splunk/dispatch/

Additionally, as of version 4.1.2, unzipped results are not cached, but are re-extracted from the index each time as needed.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The index directory is not changed. The contents are extracted in memory. As usual, search results are stored in $SPLUNK_HOME/var/run/splunk/dispatch/

Additionally, as of version 4.1.2, unzipped results are not cached, but are re-extracted from the index each time as needed.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...