Writing data to its local disk for long-term storage and searching.
Always provision 20% spare CPU and 15% spare IOPS on a Data Node beyond IBM’s official calculator. The single most common failure I’ve seen is “search timeouts due to I/O wait” – fixable only by over-speccing disk or moving to NVMe. qradar data node