Mastering Splunk

What is a Splunk index?

As mentioned on http://www.splunk.com, a Splunk index can be defined as follows:

"A Splunk index is a repository for Splunk data."

Data that has not been previously added to Splunk is referred to as raw data. When the data is added to Splunk, it indexes the data (uses the data to update its indexes), creating event data. Individual units of this data are called events. In addition to events, Splunk also stores information related to Splunk's structure and processing (all this stuff is not event data), transforming the data into its searchable events.

Splunk stores the data it indexed and its indexes within flat files (actually, files in a structured directory), meaning that it doesn't require any database software running ...