What is Splunk Indexer?

The Indexer is one of the components present in the Splunk which is used for indexing and storing the data coming from the forwarder. It transforms the incoming data into events and stores the event in the indexes for efficiently performing the search operations. If the data is received from a universal forwarder, then the indexer will parse the incoming data and index it. If the data is received from the heavy forwarder, then indexer will only index the data. The Splunk Indexer creates number of files as it indexes the data that may contain either the compressed raw data or the indexes that point to the raw data.