SPLK-1003 · Domain 4 of 17

SPLK-1003 Domain 4: Splunk Indexes

One of the three heaviest SPLK-1003 topics, Splunk Indexes tests how indexes are laid out on disk, how buckets age from hot to frozen, which indexes.conf settings control that, and how data integrity and retention are enforced.

Exam weight
10%
Official objectives
6
Estimated questions estimate
~6
Suggested study time estimate
6–9 hrs

About 12 min read Reviewed October 2026

Overview

Domain 4 has six official objectives: describe index structure, list types of index buckets, check index data integrity, describe indexes.conf options, describe the fishbucket and apply a data retention policy. Together they explain where Splunk keeps data, how a bucket moves through the hot, warm, cold, frozen and thawed stages, and what settings decide when data is rolled or removed.

At 10%, this is one of the three largest topics and should yield about six questions. Expect detail: directory names such as db, colddb and thaweddb, attributes like frozenTimePeriodInSecs and maxTotalDataSizeMB, the check-integrity command and the role of the fishbucket in tracking monitored files. Retention questions often combine age and size limits, so you need to know which limit fires first and what happens to the data when it does.

How it's tested

Questions often show part of an indexes.conf stanza and ask what happens to data over time, or describe a storage or compliance requirement and ask which attribute to set. Expect bucket-stage sequencing, path attributes, integrity checks and fishbucket behaviour, often with default values in the answer options.

  • Predict the bucket's fate

    Given age and size settings, you decide when a bucket rolls or freezes and whether its data is deleted or archived.

  • Pick the attribute

    A requirement such as six months of retention or a 200 GB cap is described and you choose the indexes.conf setting.

  • Recognise the stage

    You identify whether a bucket is hot, warm, cold, frozen or thawed from its description or directory.

Reasoning it through

Security wants 90 days of firewall data kept, then copied to cheap storage instead of deleted. The candidate sets frozenTimePeriodInSecs to 7776000 for 90 days and adds coldToFrozenDir pointing at the archive path. Without coldToFrozenDir or a script, frozen buckets are deleted. A maxTotalDataSizeMB set too low could freeze data earlier, since whichever limit is reached first applies.

Objectives 6

Official objectives from the Splunk outline, in outline order.

4.1 Describe index structureIndex directories, rawdata journal and tsidx files.
What it means
Each index is a set of directories under $SPLUNK_DB, which defaults to $SPLUNK_HOME/var/lib/splunk. The homePath, usually db, holds hot and warm buckets; coldPath, usually colddb, holds cold buckets; and thawedPath, thaweddb, holds restored data. Every bucket contains compressed raw data in a journal file and time-series index (tsidx) files that point into it.
What to understand
Splunk ships default indexes such as main, _internal, _audit and _introspection. Event indexes store events; metrics indexes store metric data points. Bucket directory names encode the newest and oldest event times, which Splunk uses to skip buckets outside a search's time range.
How it shows up
You identify which directory or file type holds a given part of an index.
Common confusion
Thinking tsidx files hold the raw events rather than pointers to the compressed journal.
4.2 List types of index bucketsHot, warm, cold, frozen and thawed.
What it means
Data is written to hot buckets, which are open for writing and searchable. When a hot bucket reaches its size or time limit, or Splunk restarts, it rolls to warm and becomes read only. Warm buckets roll to cold when warm count or home path size limits are reached. Cold buckets roll to frozen when retention limits are reached. Thawed buckets are frozen archives an admin has restored for searching.
What to understand
Only hot buckets are written to. Warm and cold buckets are searchable; frozen data is not searchable and is deleted unless archived. Thawed data does not count toward size limits and is not aged out automatically. Rolling from warm to cold often moves data to cheaper storage.
How it shows up
A stage description is given and you name the bucket type, or you order the lifecycle correctly.
Common confusion
Believing frozen data remains searchable or that thawed buckets age out like cold ones.
4.3 Check index data integrityHash-based integrity checking for buckets.
What it means
Splunk can compute hashes for slices of raw data as it is indexed, so you can later prove data has not been altered. This is enabled per index with enableDataIntegrityControl = true in indexes.conf. The splunk check-integrity command verifies a bucket or an entire index against the stored hashes.
What to understand
Integrity control must be enabled before data arrives; existing buckets without hashes cannot be verified the same way. Hash files sit inside each bucket. Results report whether slices match, which supports audit and compliance needs.
How it shows up
A compliance requirement to prove log data is unchanged leads to the integrity setting and command.
Common confusion
Assuming integrity checking is on by default for every index.
4.4 Describe indexes.conf optionsPath, size and age attributes that control indexes.
What it means
indexes.conf defines each index in a stanza named after it. Key attributes include homePath, coldPath and thawedPath; maxTotalDataSizeMB for the overall index cap; frozenTimePeriodInSecs for age-based retention; maxDataSize for hot bucket size; maxHotBuckets and maxWarmDBCount for bucket counts; and coldToFrozenDir or coldToFrozenScript for archiving. datatype = metric creates a metrics index.
What to understand
Know the defaults roughly: maxTotalDataSizeMB is 500,000 MB and frozenTimePeriodInSecs is about six years. Path attributes accept volume references so several indexes can share a size-capped volume. New indexes created in indexes.conf usually require a restart, and in an indexer cluster they are distributed through the cluster manager with repFactor = auto.
How it shows up
A requirement is described and you choose the attribute that satisfies it.
Common confusion
Using maxDataSize, which sizes individual hot buckets, to cap total index size.
4.5 Describe the fishbucketFile-tracking checkpoints for monitored inputs.
What it means
The fishbucket is a special internal store, under $SPLUNK_DB/fishbucket, that records a CRC of the start of each monitored file and a seek pointer showing how far Splunk has read. It lets Splunk resume where it left off and avoid re-indexing the same data after a restart.
What to understand
It does not hold event data. To re-index a single file, reset its entry with the btprobe utility; clearing the whole fishbucket re-reads every monitored file and can duplicate data and consume license. Files with identical first bytes can be mistaken for each other, which is what crcSalt addresses.
How it shows up
A file is not being re-indexed or is being duplicated and you identify the fishbucket's role.
Common confusion
Thinking the fishbucket is an index of events or a quarantine for bad data.
4.6 Apply a data retention policyAge and size limits and what happens on freeze.
What it means
Retention combines age and size controls. frozenTimePeriodInSecs freezes buckets whose newest event is older than the limit. maxTotalDataSizeMB, and volume or path size limits, freeze the oldest buckets when space runs out. Whichever condition is met first triggers the freeze. By default frozen buckets are deleted; set coldToFrozenDir or coldToFrozenScript to archive them.
What to understand
A bucket is only frozen when all its events are older than the retention period, so data can survive longer than the setting suggests. Size limits can freeze data younger than the age limit. To search archived data again, copy it into thaweddb and rebuild it.
How it shows up
A retention requirement is given and you choose the setting, or you predict when data will be removed.
Common confusion
Expecting frozen data to be archived automatically without coldToFrozenDir or a script.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • $SPLUNK_DB

    Root directory for index data, by default $SPLUNK_HOME/var/lib/splunk.

    Remember
    Each index has db, colddb and thaweddb paths.
    Tested as
    Index structure questions.
    Trap
    Looking for indexes under etc.

  • Hot bucket

    The only bucket type being written to.

    Remember
    Rolls to warm on size, time or restart.
    Tested as
    Lifecycle questions.
    Trap
    Thinking warm buckets are writable.

  • Warm bucket

    Read-only, searchable, in homePath.

    Remember
    maxWarmDBCount limits how many stay warm.
    Tested as
    Roll-to-cold questions.
    Trap
    Placing warm data in colddb.

  • Cold bucket

    Older searchable data in coldPath.

    Remember
    Often on slower, cheaper storage.
    Tested as
    Storage tiering questions.
    Trap
    Thinking cold data is unsearchable.

  • Frozen

    Data past retention; deleted by default.

    Remember
    Archive with coldToFrozenDir or coldToFrozenScript.
    Tested as
    Retention outcome questions.
    Trap
    Assuming automatic archiving.

  • Thawed

    Restored frozen data in thaweddb.

    Remember
    Not subject to retention or size limits.
    Tested as
    Restore questions.
    Trap
    Expecting it to age out.

  • frozenTimePeriodInSecs

    Age-based retention per index.

    Remember
    Evaluated on the newest event in a bucket.
    Tested as
    Retention setting questions.
    Trap
    Using the oldest event.

  • maxTotalDataSizeMB

    Cap on total index size, default 500,000 MB.

    Remember
    Oldest buckets freeze when reached.
    Tested as
    Size cap questions.
    Trap
    Confusing it with maxDataSize.

  • enableDataIntegrityControl

    Turns on hash generation for an index.

    Remember
    Verify with splunk check-integrity.
    Tested as
    Compliance questions.
    Trap
    Assuming it is on by default.

  • Fishbucket

    Stores CRC and seek pointers for monitored files.

    Remember
    Reset one file with btprobe.
    Tested as
    Re-indexing questions.
    Trap
    Thinking it stores events.

  • tsidx and journal

    tsidx files index terms; the journal holds compressed raw data.

    Remember
    Both live inside each bucket.
    Tested as
    Structure questions.
    Trap
    Swapping their roles.

  • Volumes

    Named storage locations with a size cap shared by indexes.

    Remember
    Referenced in homePath and coldPath.
    Tested as
    Storage questions.
    Trap
    Thinking volumes replace indexes.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Bucket stages

ConceptMeaningKey differenceCommon trap
Hot Actively written Writable and searchable Thinking several stages are writable
Warm Recently rolled data Read only, homePath Placing it in coldPath
Cold Older data Searchable, coldPath Thinking it is unsearchable
Frozen Past retention Deleted or archived, not searchable Assuming archiving by default
Thawed Restored archive Searchable, exempt from aging Expecting it to roll again

Retention controls

ConceptMeaningKey differenceCommon trap
frozenTimePeriodInSecs Age limit Uses newest event in bucket Using oldest event
maxTotalDataSizeMB Total index size cap Freezes oldest buckets first Confusing with maxDataSize
coldToFrozenDir Archive location Prevents deletion on freeze Thinking archiving is default

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Frozen is archived

    What candidates pick
    Say data is moved to an archive when it freezes.
    Why it looks right
    Frozen sounds like cold storage.
    Why it's wrong
    Without coldToFrozenDir or coldToFrozenScript, Splunk deletes frozen buckets.

    Clue to watch for The stanza has no archive setting.

  2. Oldest event decides

    What candidates pick
    Predict a bucket freezes when its oldest event is past retention.
    Why it looks right
    Age limits usually apply per record.
    Why it's wrong
    Splunk freezes a whole bucket only when its newest event is older than frozenTimePeriodInSecs.

    Clue to watch for Buckets span a wide time range.

  3. maxDataSize caps the index

    What candidates pick
    Set maxDataSize to limit total storage.
    Why it looks right
    The name mentions data size.
    Why it's wrong
    maxDataSize controls hot bucket size; maxTotalDataSizeMB caps the index.

    Clue to watch for The requirement is a total storage limit.

  4. Fishbucket holds events

    What candidates pick
    Look for lost events in the fishbucket.
    Why it looks right
    It is stored like an index.
    Why it's wrong
    It holds only CRC checks and read offsets for monitored files.

    Clue to watch for The scenario is about re-reading files.

  5. Thawed ages out

    What candidates pick
    Expect thawed data to be frozen again on schedule.
    Why it looks right
    All other buckets follow retention.
    Why it's wrong
    Thawed buckets are excluded from retention and size limits and must be removed manually.

    Clue to watch for Data was restored from an archive.

  6. Integrity is retroactive

    What candidates pick
    Enable integrity control and verify last year's buckets.
    Why it looks right
    The setting sounds global.
    Why it's wrong
    Hashes are only generated for data indexed after the setting is enabled.

    Clue to watch for Buckets predate the change.

Answer framework

Use this sequence for any question about how Splunk stores, ages or protects indexed data.

  1. Identify the bucket stage involved and decide whether its data is writable, searchable or already outside the scope of Splunk searches.
  2. Locate the relevant path attribute, homePath, coldPath or thawedPath, and any volume or size cap that applies to that storage location.
  3. For retention, evaluate both the age limit, using the newest event in each bucket, and the size limits, then apply whichever triggers first.
  4. Decide what happens on freeze: deletion by default, or archiving when coldToFrozenDir or coldToFrozenScript is set.
  5. For integrity or re-reading problems, check whether enableDataIntegrityControl was active at index time and whether the fishbucket entry needs a targeted reset.

Practice question

An index stanza sets frozenTimePeriodInSecs = 2592000 and maxTotalDataSizeMB = 100000 and has no other retention settings. The index reaches 100,000 MB after 20 days of data. What happens to the oldest buckets?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this topic about twice the time of a 5% topic. Begin with the bucket lifecycle: draw the five stages left to right, write the directory each lives in, mark which are writable and searchable, and list what triggers each roll. This diagram anchors every other objective.

Next, create a test index in a lab with a custom indexes.conf stanza. Set homePath, coldPath, maxTotalDataSizeMB and frozenTimePeriodInSecs, add coldToFrozenDir, and restart. Browse the bucket directories under $SPLUNK_DB and note the journal and tsidx files. Enable enableDataIntegrityControl on a second index, send data and run splunk check-integrity against it.

Then practise retention arithmetic: convert days to seconds and work through scenarios where size and age limits compete. Finally, study the fishbucket alongside Monitor Inputs, since crcSalt and re-indexing questions connect the two. Close with timed practice on indexes.conf questions, reviewing every wrong answer against the documented defaults in the indexes.conf specification file, which lists every attribute with its default value.

FAQ

How much of SPLK-1003 is Splunk Indexes?

Splunk Indexes is 10% of the exam, about six questions, making it one of the three largest blueprint topics.

What happens to frozen data by default?

It is deleted. To keep it, set coldToFrozenDir or coldToFrozenScript in the index stanza so buckets are archived when they freeze.

When does a bucket freeze based on age?

When the newest event in the bucket is older than frozenTimePeriodInSecs. A bucket can therefore hold some events older than the limit.

What is the fishbucket?

An internal store of CRC values and seek pointers for monitored files, used to avoid re-indexing data Splunk has already read.

How do I prove indexed data has not been changed?

Enable enableDataIntegrityControl on the index before data arrives, then run splunk check-integrity on the bucket or index.

Do thawed buckets count against retention?

No. Thawed data is outside size and age limits, so an admin removes it manually when it is no longer needed.

Which is the default size cap for an index?

maxTotalDataSizeMB defaults to 500,000 MB. Size caps can also be applied through volumes shared by several indexes.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered index structure, bucket stages, integrity checks, the fishbucket and retention. Test whether you can predict what happens to stored data.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going