Fishbucket in Splunk is a sub-directory that is used to monitor or track internally how far the content of the file is indexed in Splunk. The fishbucket sub-directory achieves this feature using its two contents seek pointers and CRC (Cyclic Redundancy Check).   The default location of the fish bucket sub-directory is the $splunk_home/splunk/var/lib. To see the content of fishbucket, we can search it under the “index=_thefishbucket” in Splunk GUI  Working: The Splunk monitoring processor selects and reads the data of a new file and then hashes data into a begin and end cyclic redundancy check (CRC), which work as sa fingerprint representing the file content.  This CRC is further used to look up an entry in a database that contains all the beginning CRCs of files it has seen before.  The first step includes a file monitor processor that searches the fish bucket to see if the CRC from the beginning of the file is present there already or not.   This can lead to three possible scenarios:  Case 1. If CRC is not present in fishbucket, the file is indexed as new. This implies the file has never been indexed. After indexing, it stores CRC and seeks the pointer inside fishbucket.  Case 2. If CRC is present in fishbucket and seek pointer is same as the current end of file, this means the file has already been indexed and nothing has changed in the file since last indexed. Seek pointers are used to check if there is a file or not.  Case 3: If CRC is present in fishbucket and seek point is beyond the current end of file, this means something in part of the file which we have already read has been changed. In this case, we were not able to know what has been changed, we can re-index the whole data.