# Indexes in Splunk

**What is an Index in Splunk?**

* An **index** is a storage container in Splunk where data is stored.
* Splunk indexes raw data and its metadata (like timestamps, source, etc.) for efficient search and analysis.
* Examples: `main` (default), `audit`, `internal`, or custom indexes you create for specific data sources.

**Key Index Types**

1. **Events Index**: Stores log or event data (most common type).
2. **Metrics Index**: Optimized for numerical data (e.g., performance metrics).
3. **Summary Index**: Stores processed results of scheduled searches for faster reporting.

Understanding and efficiently managing indexes ensures optimal data handling within Splunk.

<figure><img src="https://3155059101-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftpxp8dhlubc3j58Iygn5%2Fuploads%2F3vkDVxEOLEg4FTVrraDU%2Fimage.png?alt=media&#x26;token=3550c43a-911b-49de-89e3-070f29e9a05e" alt=""><figcaption></figcaption></figure>

**All these are default indexes in splunk which can't be deleted or disabled.**

<figure><img src="https://3155059101-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftpxp8dhlubc3j58Iygn5%2Fuploads%2Fh6UHnmC6caCI7eCUfUTA%2Fimage.png?alt=media&#x26;token=9cd436c6-c686-4200-9534-45e7947d2d83" alt=""><figcaption></figcaption></figure>

Still issue on searching. Wait let's fix this first.&#x20;

Adjust Splunk's Minimum Free Space Requirement

```bash
sudo nano /opt/splunk/etc/system/local/server.conf

```

<pre class="language-bash"><code class="lang-bash"><strong># Add or modify:
</strong>
[diskUsage]
minFreeSpace = 500

Copy code

</code></pre>

<figure><img src="https://3155059101-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftpxp8dhlubc3j58Iygn5%2Fuploads%2FPcVjwSvLEcILxfGMU6Og%2Fimage.png?alt=media&#x26;token=b620e21b-1eaa-4681-a324-f86cc3f90608" alt=""><figcaption></figcaption></figure>

```bash
# save and restart
sudo /opt/splunk/bin/splunk restart

```

It's should work now. Please wait for a while and try a sample search index.

```
index="_internal"
```

<figure><img src="https://3155059101-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftpxp8dhlubc3j58Iygn5%2Fuploads%2Fj2RHx3qp5sSbINT89lIW%2Fimage.png?alt=media&#x26;token=b8034f83-00de-4156-9936-cad7864f1843" alt=""><figcaption></figcaption></figure>

Waah! It's working now. Cool, we can move forward to our Splunk learning.
