A bucket in Splunk is basically a directory for storing data and index files. Each bucket contains data events in a particular time frame. As data ages, buckets move through different stages as given below:   Hot bucket: A hot bucket contains newly indexed data. It is open for writing. Every index contains one or more hot buckets.  Warm bucket: This bucket contains data that has been rolled or pulled out of the hot bucket. The warm buckets are numerous.  Cold bucket: This bucket contains data that has been rolled or pulled out of the warm bucket. The cold buckets are also numerous.  Frozen bucket: A frozen bucket is comprised of data rolled out from a cold bucket. The indexer deletes frozen data by default, but we can archive it. Archived data can later be thawed (data in a frozen bucket is not searchable).  Buckets are by default located in the below folder:  $SPLUNK_HOME/var/lib/splunk/defaultdb/db.