topic Index freezing - event or bucket timestamp in Getting Data In

Index freezing - event or bucket timestamp

MHibbin — Thu, 01 Aug 2013 14:11:29 GMT

Hi there,

Quick one, does Splunk freeze data based on bucket timestamp or event timestamp?

Cheers,

MHibbin

Re: Index freezing - event or bucket timestamp

sowings — Thu, 01 Aug 2013 14:20:14 GMT

Event. The oldest bucket where the latestTime is completely outside of the time window. If freezing based on size, the oldest bucket by latestTime, regardless of whether it's outside the time window. I've seen (small) indexes roll from hot to warm and then immediately freeze!

Re: Index freezing - event or bucket timestamp

reedmohn — Tue, 26 Sep 2017 14:36:59 GMT

I though it was index time(?)

That's not necessarily the same as event time, for instance if you add a new forwarder, but it collects logs with events from far back in time.