Home > Workload Solutions > Data Analytics > White Papers > White Paper—Cloud Native Splunk Enterprise with SmartStore—Predictive Maintenance for IT Operations > Data buckets
Splunk Enterprise stores indexed data in buckets, which are directories containing both the data and index files into the data. An index typically consists of many buckets, organized by age of the data.
Indexing requires significant compute and storage resources. Splunk divides data into five tiers or “buckets,” depending on the age of the data and the level of activity in terms of the need for access to the data. The primary buckets are described as:
Hot—the most current, active data that is being searched
Warm—read-only data that is still begin searched
Cold—archived read-only data that is rarely searched
There may also be Frozen buckets, for data that is no longer in active storage or has been deleted, and Thawed buckets, for frozen data that has been restored.
The data bucket capability aids in both the performance and the cost efficiency of Splunk Enterprise and its associated storage infrastructure.