https://community.splunk.com/t5/Getting-Data-In/Data-Retention-and-Warm-Buckets/m-p/87483#M18139 <P>My understanding is that a retention policy operates on the events in my cold buckets, meaning that when data grows beyond a certain size I specify for the index, Splunk deletes the oldest data from the cold bucket.</P> <P>However, if my events never roll from warm to cold bucket, will Splunk still honor my retention policy and delete the data from my warm buckets?</P> Thu, 06 Oct 2011 15:32:10 GMT maverick 2011-10-06T15:32:10Z https://community.splunk.com/t5/Getting-Data-In/Data-Retention-and-Warm-Buckets/m-p/87483#M18139 <P>My understanding is that a retention policy operates on the events in my cold buckets, meaning that when data grows beyond a certain size I specify for the index, Splunk deletes the oldest data from the cold bucket.</P> <P>However, if my events never roll from warm to cold bucket, will Splunk still honor my retention policy and delete the data from my warm buckets?</P> Thu, 06 Oct 2011 15:32:10 GMT https://community.splunk.com/t5/Getting-Data-In/Data-Retention-and-Warm-Buckets/m-p/87483#M18139 maverick 2011-10-06T15:32:10Z https://community.splunk.com/t5/Getting-Data-In/Data-Retention-and-Warm-Buckets/m-p/87484#M18140 <P>maybe you can limit the max warm db count with properly adjusting your warm bucket size to enforce it to roll into cold bucket. refer to <A href="http://splunk-base.splunk.com/answers/2392/how-can-i-rotate-all-hot-and-warm-buckets-older-than-30-days-into-cold-storage">this discussion</A></P> Fri, 07 Oct 2011 08:40:20 GMT https://community.splunk.com/t5/Getting-Data-In/Data-Retention-and-Warm-Buckets/m-p/87484#M18140 hjwang 2011-10-07T08:40:20Z