https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-seem-to-have-more-than-90-days-of-data-with-our/m-p/262263#M50342 <P>Any thoughts, by any chance, on this one?</P> Tue, 24 May 2016 13:27:23 GMT ddrillic 2016-05-24T13:27:23Z https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-seem-to-have-more-than-90-days-of-data-with-our/m-p/262262#M50341 <P>We changed frozenTimePeriodInSecs = 10368000 (120 days from 90 days) for the layer7 index 30 days ago. </P> <P>It shows the following:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1386iE65C6455F7C012E0/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>However, when it reached the the three months break of 2/23, it showed <CODE>1,401,173,823 of 1,401,173,823 events matched</CODE>, but no events kept showing up. We ended up with 2.1 billion events processed. So, it seems as though Splunk has more than 90 days of data, but it stops showing events at the 90 days break.</P> <P>On the indexer, under the cold bucket, the oldest directory is of 2/23.</P> <P>What can it be?</P> Tue, 24 May 2016 02:21:27 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-seem-to-have-more-than-90-days-of-data-with-our/m-p/262262#M50341 ddrillic 2016-05-24T02:21:27Z https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-seem-to-have-more-than-90-days-of-data-with-our/m-p/262263#M50342 <P>Any thoughts, by any chance, on this one?</P> Tue, 24 May 2016 13:27:23 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-seem-to-have-more-than-90-days-of-data-with-our/m-p/262263#M50342 ddrillic 2016-05-24T13:27:23Z https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-seem-to-have-more-than-90-days-of-data-with-our/m-p/262264#M50343 <P>You didn't show the time period you picked for your search. If it was last 90 days then it would only show events for that range.</P> <P>As far as the frozenTimePeriodInSecs setting, a bucket will only be frozen if the youngest event in the bucket exceeds that time period. So there could be buckets with most of their events past 90 days but not all so it will still be in the cold db.</P> Tue, 24 May 2016 14:58:33 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-seem-to-have-more-than-90-days-of-data-with-our/m-p/262264#M50343 sjohnson_splunk 2016-05-24T14:58:33Z https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-seem-to-have-more-than-90-days-of-data-with-our/m-p/262265#M50344 <P>Thank you for the help - we "simply" ran out of space for this specific index of 500 GBs. it coincided with the 90 days period which threw us off.</P> Tue, 24 May 2016 19:20:49 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-seem-to-have-more-than-90-days-of-data-with-our/m-p/262265#M50344 ddrillic 2016-05-24T19:20:49Z