Splunk online course

How to Create and Configure an Index in Splunk

Learn how to create a Splunk index using Splunk Web, the CLI, or indexes.conf, and configure paths, retention, bucket size, and storage limits.

What a Splunk index does

An index is a named Splunk data store that receives indexed events and makes them available for search. Inputs and forwarding configurations assign incoming data to an index, and searches can restrict results with an expression such as index=app_logs.

Splunk stores indexed data in physical groups called buckets. A bucket moves through lifecycle stages as it ages:

• Hot: actively receives newly indexed data.
• Warm: is no longer actively written to but remains searchable.
• Cold: is older searchable data stored in the configured cold location.
• Frozen: has reached the end of its active retention lifecycle and is deleted or archived.
• Thawed: is previously frozen data restored so it can be made available again.

Separate indexes help administrators isolate data for access control, different retention requirements, ownership, storage performance, and capacity planning. For example, production application logs may need longer retention and tighter access than development logs.

Ways to create an index

Splunk Web is usually the simplest choice for a single routine change. Configuration-file management is preferable when definitions must be reviewed in source control, deployed consistently to multiple indexers, or maintained as part of an application or deployment package.

Plan the index before creating it

• Administrative access: Use an administrative role or equivalent capability that permits index administration.
• Name: Choose a stable name before onboarding data. Inputs, searches, roles, and deployment configurations will reference it.
• Ingestion volume: Estimate the average and peak data rate, including expected growth.
• Retention: Decide how long data should remain in active searchable storage before it freezes.
• Bucket sizing: Select a suitable maximum bucket size for the storage and workload.
• Storage locations: Decide where hot and warm, cold, thawed, and optionally archived frozen data will reside.
• Capacity: Confirm that the relevant filesystems have enough free space for the expected volume and retention period.
• Permissions: Ensure each selected directory exists, is mounted when required, and is writable by the Splunk service account.
• Archive policy: If frozen data must be preserved, plan archive capacity, permissions, backup, recovery, and compliance controls.

Index naming rules

Use only lowercase letters, numerals, underscores, and hyphens. An index name must not begin with an underscore or hyphen. A descriptive, stable name should identify the data domain or environment.

Renaming an index later can be disruptive because existing inputs, searches, role definitions, dashboards, and deployment settings may still reference the old name. Treat the name as an interface contract.

Understand index paths and bucket locations

The paths describe where buckets live as they move through the lifecycle. A frozen archive is not automatically an active searchable index. When archived data is needed, it must be restored through the organization's thawing procedure into the thawed location before it can be made available again.

Index size and retention settings

The total index size limit controls the cumulative storage used by an index. The setting maxTotalDataSizeMB expresses this limit in megabytes. Splunk documentation commonly identifies a default total-index limit of 500,000 MB, but validate the default for the installed Splunk version and your deployment policy before relying on it.

The maximum bucket size controls the target size of individual buckets. The maxDataSize setting influences bucket rollover and the size of hot, warm, and cold buckets. A value such as auto allows Splunk to use its automatic sizing behavior, subject to the installed version and architecture.

Retention determines when data reaches the frozen stage. The frozenTimePeriodInSecs setting defines the retention period in seconds. Size limits and time limits work together: data can age out because it reaches its retention period or because the index reaches a configured size boundary.

Insufficient storage limits, undersized filesystems, or an inaccurate ingest estimate can lead to earlier-than-expected data aging or ingestion failures. Revisit these settings when data volume or retention requirements change.

Create an index in Splunk Web

1. Sign in to Splunk Web with an account that has the required administrative permissions. Splunk Web is the browser-based administration interface.
2. Open Settings and select the Indexes management page.
3. Choose the control to create a new index.
4. Enter the index name, such as app_logs.
5. Configure the home path, cold path, thawed path, retention, total-size limit, and bucket-size settings as required. Use the default paths only when they fit the storage plan.
6. Optionally associate the index with an app when the index definition belongs to a specific application context.
7. If long-term preservation is required, configure the frozen archive destination according to your Splunk version and archive process.
8. Save the definition.
9. Return to the index list and verify that the new index appears.

For example, create app_logs with the default home, cold, and thawed locations when no custom storage layout is needed. Select a retention and total-size policy based on the application's expected log volume, then verify it with a test event.

Create an index with indexes.conf

indexes.conf is the Splunk configuration file that defines indexes and their storage and lifecycle settings. An index is represented by a stanza whose name matches the index name. Put custom settings in the appropriate local configuration layer rather than editing shipped default files.

[app_logs]
homePath = $SPLUNK_DB/app_logs/db
coldPath = $SPLUNK_DB/app_logs/colddb
thawedPath = $SPLUNK_DB/app_logs/thaweddb
maxTotalDataSizeMB = 102400
maxDataSize = auto
frozenTimePeriodInSecs = 7776000

$SPLUNK_DB is a Splunk configuration variable commonly used as the base directory for index data. The example represents a 90-day retention period and a 102,400 MB total limit, but these are illustrative values, not universal recommendations.

If expired data must be retained, add the appropriate frozen-archive configuration for the installed Splunk release and operational design. The archive location must be writable and must have its own capacity, backup, recovery, and compliance plan.

After editing the file, apply the configuration through the appropriate deployment or reload procedure. Some changes require a Splunk restart, while others can be reloaded depending on the setting and architecture. In a distributed deployment, place and deploy the definition on the component that owns the index configuration, normally the receiving indexer or indexer cluster management workflow.

Create an index from the Splunk CLI

The Splunk CLI is the command-line management interface installed with Splunk. It is useful when an administrator is working directly on a Splunk host or automating operational tasks.

splunk add index app_logs

• Run the command with an account authorized to administer Splunk.
• Supply authentication as required by the installed service and security policy.
• Run it in the correct Splunk installation context and service-account environment.
• Check the exact command syntax, authentication behavior, and supported options against the installed Splunk version.

The representative command creates the index definition, but detailed path, retention, and size options vary by release and deployment. For repeatable multi-host changes, a managed indexes.conf deployment is usually easier to review and standardize.

Frozen data and archival decisions

Frozen data has completed its active retention lifecycle. If no archive workflow is configured, Splunk may delete it when it freezes. A frozen path or equivalent archive destination is optional and should be used when the data must be preserved outside active index storage.

Archived frozen data and thawed data are different:

• Archived frozen data is preserved in an archive location after leaving the active lifecycle.
• Thawed data is a restored copy or set of buckets placed in the thawed location so it can be made available for searching again.

For example, an organization may archive security logs after active retention to satisfy a compliance requirement. If investigators later need those logs, the required buckets are restored to thawed storage using the organization's documented recovery process.

Verify the index after creation

1. Confirm that the index appears in the Splunk Web index list or in the relevant configuration output.
2. Send or route one known test event to the new index.
3. Run a narrow search scoped to that index:

index=app_logs

4. Confirm that the expected event is searchable and that its timestamp and source fields are correct.
5. Check the configured home, cold, and thawed paths on the relevant host.
6. Verify ownership and write permissions for the Splunk service account.
7. Monitor disk usage and filesystem health after initial ingestion.

If the test event does not appear, verify that the input is assigned to app_logs, the search explicitly names the correct index, the searcher's role permits access, and the input or forwarding configuration has been applied. For data onboarding background, see Data Sources and What Are Forwarders.

Troubleshoot common creation and ingestion problems

The New Index option is unavailable

Usually, the signed-in user lacks the required administrative capability or the active role and app context does not permit index administration. Verify the role and capabilities, or ask an authorized administrator to create the index.

The index name is rejected

Check for unsupported characters, a leading underscore or hyphen, or a conflict with an existing index. Use lowercase letters, digits, underscores, and hyphens, and check the index list and configuration for an existing stanza.

The index exists but searches return no data

The input may send events to another index, the search may use the wrong index, the role may not grant access, or an input or forwarding change may not have been applied. Verify the input assignment, search with index=<index_name>, review role-based index access, and check ingestion or forwarding status.

Filesystem errors occur

Confirm that every configured home, cold, thawed, and frozen archive directory exists on the relevant host, is writable by the Splunk service account, and has adequate capacity. Also check that required mounts are available and healthy.

Data ages out too soon or storage grows unexpectedly

Compare actual daily ingest volume with maxTotalDataSizeMB, maxDataSize, retention, and available disk. Adjust the capacity and retention policy through approved change control. If preservation is required, configure and test frozen-data archiving rather than assuming expired data will remain available.

Key exam and administration notes

• An index is the named destination and storage location for indexed events; it is not merely a search filter.
• Home storage holds hot and warm buckets, cold storage holds cold buckets, and thawed storage holds restored frozen data.
• Frozen storage is optional and is used for archival preservation when data should not be discarded at expiration.
• maxTotalDataSizeMB limits cumulative index size, while maxDataSize controls target bucket size.
• frozenTimePeriodInSecs controls the configured time before data freezes.
• Validate defaults, supported settings, and reload behavior against the installed Splunk version and deployment architecture.
• Use local configuration layers for custom settings and avoid editing shipped default files.
• Always verify both configuration existence and real event searchability after creating an index.