Splunk does not use any database to store its data, as it extensively makes use of its indexes to store the data but Splunk uses MongoDB to facilitate certain internal functionality like the kvstore.
Splunk ingests the data from external sources like Universal forwarder etc. all go to a data store called index as specified in your configuration and it is not like a traditional database.
You can learn Splunk by taking up this Splunk Certification program by Intellipaat.
I recommend this video on Splunk Architecture to get familiar with Splunk:
Back