- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- where is data stored if we are using APP on search...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello All
i have a doubt regarding the data storage. i am clear that my data is stored on INDEXERS in buckets. if i am using a APP on my search head in this case where will be my data stored which will be available for later searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
The Indexed data is always stored in the indexers. Usually the apps has a part for the SH (with dashoards, fields extractions, eventypes...). And there is another part of the app for the indexers (with the parsing options, props.conf). Depending on the app it should be distributed in a way or another. If you have doubts deploy the same app in the SH and IDX. But in any case, the data always will be on the indexers
regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
The Indexed data is always stored in the indexers. Usually the apps has a part for the SH (with dashoards, fields extractions, eventypes...). And there is another part of the app for the indexers (with the parsing options, props.conf). Depending on the app it should be distributed in a way or another. If you have doubts deploy the same app in the SH and IDX. But in any case, the data always will be on the indexers
regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for quick response.
so as per your answer i came to conclusion that all the data is stored on indexers even the app is installed on SEARCH HEAD. am i correct??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you are correct (there are some data, like lookups and KV Store data, that lives on the SH, but indexed data always on the indexers)
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
