https://community.splunk.com/t5/Deployment-Architecture/Delete-Indexed-data/m-p/97359#M3597 <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Setaretirementandarchivingpolicy">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Setaretirementandarchivingpolicy</A></P> Mon, 24 Oct 2011 21:13:55 GMT gkanapathy 2011-10-24T21:13:55Z https://community.splunk.com/t5/Deployment-Architecture/Delete-Indexed-data/m-p/97358#M3596 <P>I want to know when data are moved from Hot to Warm bucket? does it depend on the date it was indexed in Splunk? or does it depend on the size of the Hot Bucket setting? where do i modify this setting?<BR /> I saw on the documentation that the maximum size for an index is 500,000MB. Will Splunk only delete data when it reach the 500,000MB limit? or will it still delete the data as long as it reached the Frozen bucket stage? what usually is the time frame before data are deleted from Splunk?</P> Mon, 24 Oct 2011 19:50:38 GMT https://community.splunk.com/t5/Deployment-Architecture/Delete-Indexed-data/m-p/97358#M3596 eantonio 2011-10-24T19:50:38Z https://community.splunk.com/t5/Deployment-Architecture/Delete-Indexed-data/m-p/97359#M3597 <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Setaretirementandarchivingpolicy">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Setaretirementandarchivingpolicy</A></P> Mon, 24 Oct 2011 21:13:55 GMT https://community.splunk.com/t5/Deployment-Architecture/Delete-Indexed-data/m-p/97359#M3597 gkanapathy 2011-10-24T21:13:55Z