Hi Splunkers,
While splunking on bucket statistics - I've noticed that despite the fact of default 90 days set for maxHotSpanSecs, I find many buckets (which are not quarantine buckets) with timespan (difference between latest and earliest) around 600 or even 800 days. On the other hand I can also easily find out buckets with timespan of 2 days. Does anyone knows why this could happen ?
Is it possible to clearly determine rules based on which Splunk assigns timespan for hot buckets ?
For checking out my statistics I use below search:
index=_internal component=IndexWriter bucket="hot_*" idx=*
| eval bucket_timespan=latest-earliest
| eval bucket_timespan=(bucket_timespan/60/60/24)
| where bucket_timespan > 90 OR bucket_timespan < 3
