Deployment Architecture

Delete Indexed data

eantonio
Path Finder

I want to know when data are moved from Hot to Warm bucket? does it depend on the date it was indexed in Splunk? or does it depend on the size of the Hot Bucket setting? where do i modify this setting?
I saw on the documentation that the maximum size for an index is 500,000MB. Will Splunk only delete data when it reach the 500,000MB limit? or will it still delete the data as long as it reached the Frozen bucket stage? what usually is the time frame before data are deleted from Splunk?

Tags (3)
0 Karma
1 Solution
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...