Moving on.
The next component of Splunk is the indexer, which is the core component of any Splunk installation.
The indexer is the one which does hold heavy lifting in a Splunk environment, and indexer is the place
where all the data will be stored on the Splunk.
The more efficient your indexer is, the more better your Splunk environment health will be.
To define an indexer, it is a component of Splunk where the data is passed.
When I say pass.
It is known as breaking down of events into smaller, manageable pieces by Splunk.
So to define an indexer, it is a component of Splunk where the data is passed or broken down.
And stored in the indexer.
The role of the indexer is to pass the data and to pass the data inside Splunk.
And this stored data is where all your queries that are run by the searcher for fetching reports or
creating alerts will be run and the results will be given back to the searcher for visualization or
sending it out an email.