topic Old Data in Hot Buckets in Splunk Enterprise

Old Data in Hot Buckets

phanichintha — Wed, 15 Jul 2020 14:02:02 GMT

Hello,

In my indexer i have old data in hot buckets why can any once help me I don't want this old data in hot buckets.

Re: Old Data in Hot Buckets

richgalloway — Wed, 15 Jul 2020 15:56:31 GMT

I'll assume you've restarted Splunk since 2017. Since a restart would have rolled those buckets to warm, I would say you're ingesting data with old timestamps.

Re: Old Data in Hot Buckets

phanichintha — Wed, 15 Jul 2020 16:13:36 GMT

Hello Rich, Thanks for your swift response.

I restart the indexer twice in a month, so i need a solution that old data can move to warm buckets. I don't need any old data in hot buckets. I need day-wise(latest) data only in hot buckets. what should i do now?

Re: Old Data in Hot Buckets

richgalloway — Wed, 15 Jul 2020 17:19:43 GMT

If you restart the indexer twice a month then there should be no hot buckets more than 2 weeks old. In theory, all hot buckets would have timestamps in the last two weeks, but sometimes data arrives with old/bad timestamps. When that happens, a new hot bucket will be created for that old data. I suspect this is what you are seeing, but it's a little hard to grok the Excel spreadsheet in your screen shot.

Re: Old Data in Hot Buckets

phanichintha — Thu, 16 Jul 2020 06:52:10 GMT

Thank you, Rich,

After i restarted the Indexer the changes happen.