Deployment Architecture

What is the difference between rb bucket and db bucket?

aalhabbash1
Path Finder

Hi Splunker;

What is the difference between rb_* and db_* under splunk_cold and splunk_hot directory storage? you can see the example below.

rb_1564000917_1563984040_7538_0B51C6C4-28F7-4348-A8F4-51FD8D156178
db_1562576411_1562565181_7654_B0AF5CBE-9B45-46D7-B374-E398083AFE9E

And can I remove the rb bucket or not?

Regards

toney_mu
New Member
.db Files: The .db files in the frozen directory are SQLite database files. These files store the indexed and compressed data in a structured format for efficient retrieval. Splunk uses SQLite as a lightweight embedded database engine for managing and organizing indexed data. .rb Files: The .rb files are Splunk's "Rolling Bloom Filter" files. They are part of the Splunk indexing process and contain metadata used for efficient searching and filtering of data. The Rolling Bloom Filter is a probabilistic data structure that helps to quickly determine if a particular term or value is likely to exist in an index block, reducing the need for expensive disk I/O operations during searches.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Buckets starting with "rb_" are replicated buckets - copies of buckets from other indexers in the cluster.
Do not delete them. If you do, Splunk will just re-create them.
Don't bother backing them up, either. You'll just waste backup time and storage. Splunk will re-create the rb buckets after the backup is restored.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...