An index in Splunk is a storage pool for events, capped by size, time, or both. By default, all events will go to the index specified by defaultDatabase, which is called main but lives in a directory called defaultdb.
An index in Splunk is a storage pool for events, capped by size, time, or both. By default, all events will go to the index specified by defaultDatabase, which is called main but lives in a directory called defaultdb.