https://community.splunk.com/t5/Getting-Data-In/Splunk-going-down-in-events-indexed/m-p/23912#M3758 <P>All day, I've been watching the amount of events indexed in Splunk go up and down. It stays in the 1.8-1.9 billion events range, but it's going up and down. Saw it at 1.96 billion today, and then it went down to 1.93 back to 1.96 and now 1.89. Is there a default setting somewhere I need to look at?</P> Tue, 10 Apr 2012 23:52:17 GMT nkitmitto 2012-04-10T23:52:17Z https://community.splunk.com/t5/Getting-Data-In/Splunk-going-down-in-events-indexed/m-p/23912#M3758 <P>All day, I've been watching the amount of events indexed in Splunk go up and down. It stays in the 1.8-1.9 billion events range, but it's going up and down. Saw it at 1.96 billion today, and then it went down to 1.93 back to 1.96 and now 1.89. Is there a default setting somewhere I need to look at?</P> Tue, 10 Apr 2012 23:52:17 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-going-down-in-events-indexed/m-p/23912#M3758 nkitmitto 2012-04-10T23:52:17Z https://community.splunk.com/t5/Getting-Data-In/Splunk-going-down-in-events-indexed/m-p/23913#M3759 <P>Check out settings in <CODE>indexes.conf</CODE>. As buckets roll from cold to frozen, they will be removed from the index and the indexed event count will go down by the number of events in the bucket.</P> <P>Good docs reference @ <A href="http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/Setaretirementandarchivingpolicy">http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/Setaretirementandarchivingpolicy</A></P> Wed, 11 Apr 2012 03:44:45 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-going-down-in-events-indexed/m-p/23913#M3759 dwaddle 2012-04-11T03:44:45Z