Answer Posted / Ram Anuj Dubey
Indexers in Splunk store data using a distributed architecture called tiered storage. Data is first stored in the hot (primary) tier, which provides fast access to recent data. As data ages, it moves to the warm (secondary) tier, and eventually to the cold (tertiary) tier for archival purposes. The indexer periodically compacts data from the hot and warm tiers to optimize storage usage.
| Is This Answer Correct ? | 0 Yes | 0 No |
Post New Answer View All Answers