I want to know when data are moved from Hot to Warm bucket? does it depend on the date it was indexed in Splunk? or does it depend on the size of the Hot Bucket setting? where do i modify this setting?
I saw on the documentation that the maximum size for an index is 500,000MB. Will Splunk only delete data when it reach the 500,000MB limit? or will it still delete the data as long as it reached the Frozen bucket stage? what usually is the time frame before data are deleted from Splunk?
