Does splunk search cold buckets data

[kplem]

A newbie here. Does Splunk actually search warm & cold buckets during a search? i know most probably it will not search frozen since it will be deleted. But how about warm & cold buckets? Thank you.

[kplem]

Hi vince,

thanks for the answer. it helps alot.

[vincesesto]

Hey kplem,

Short answer "Yes".

For a longer answer please refer to information like the following link:
http://wiki.splunk.com/Community:UnderstandingBuckets

It will give you information on how the data is searched:
When you search for something in your indexed data, Splunk gives you the results of your search in reverse chronological order-- we assume you want information about what's happening most recently first, with older results arriving later. Splunk first looks in the hot bucket, then the warm buckets, then cold. The frozen db is never searched.

When it mentions "reverse chronological order", it kind of refers to the fact that you would be limiting searches to "All Time" as this would be in the warm and cold buckets and hopefully referred to less.

Let me know if you need me to clarify this further.

Regards,

Vince