Events for an index are not retained per desired retention policies

[sagaraverma]

I have an index for which I desire to retain 45 days of events .

I have multiple values set under indexes.conf for the same :-
frozenTimePeriodInSecs = 3888000
maxDataSize=auto_high_volume
maxHotBuckets = 10
maxWarmDBCount = 15
maxTotalDataSizeMB = 512000

Although desired retention is 45 days but index is only able to retain 21 days of data.

Please be noted that I do understand meaning of all such parameters and how they may effect overall retention.

But I am looking for some method / search query which can show/evaluate - what/which parameter amongst all above is taking precedence (based on ingested volume, bucket count reach, etc) for an index and rolling buckets to age and hence letting only 21 days of data to retain. 

[richgalloway]

If I bucket is deleted sooner than expected then it's probably because of size constraints.  The index reached one of  maxTotalDataSizeMB or maxVolumeDataSizeMB.  The reason for freezing a bucket should be logged.  Search index=_internal sourcetype=splunkd component=BucketMover.

[scelikok]

Hi @sagaraverma,

Buckets get frozen by frozenTimePeriodInSecs or maxTotalDataSizeMB, whichever hits first. Your case seems to be hitting maxTotalDataSizeMB. You can check the freeze reason using below query, it will show you the reason in event_message field.

index=_internal component=BucketMover will attempt to freeze