I85PREP
⌘ K
Splunk Enterprise Certified Admin study materials
Splunk Enterprise Certified Admin study resources

Splunk Enterprise Certified Admin: Index Management

Splunk Enterprise Certified Admin · Work through your exam, one topic at a time.

All guide sections

Index Management

Index anatomy

Every index defines homePath (hot/warm), coldPath, and thawedPath in indexes.conf. Buckets progress hot → warm → cold → frozen. Rolling to warm is driven by time or size (maxHotSpanSecs, maxHotBuckets, maxDataSize); cold buckets become frozen when frozenTimePeriodInSecs elapses or maxTotalDataSizeMB for the index is exceeded. Frozen data is deleted unless coldToFrozenDir or coldToFrozenScript archives it instead.

Types and defaults

Event indexes, metrics indexes, and internal indexes (_internal, _audit, _introspection, _telemetry). Ingested events land in main unless an input sets index =. SmartStore moves cold buckets to remote object storage while keeping hot/warm local.

Traps

  • Changing path settings on an existing index - treat homePath/coldPath as fixed at creation.
  • Using splunk clean eventdata as a retention strategy; it destroys data and requires Splunk to be stopped.
  • Forgetting maxDataSize accepts auto, auto_high_volume (10 GB), and explicit sizes.
  • Editing system/default/indexes.conf instead of local.
  • Assuming all buckets roll on time only - size limits can force freezing early.

Rule of thumb

Retention is a race between volume and time: data freezes at whichever comes first, frozenTimePeriodInSecs or maxTotalDataSizeMB. Use splunk list index and | dbinspect to confirm paths, sizes, and bucket states.