How is my data still searchable? Is there something wrong with indexes.conf?

[liuyongkang]

hi everyone :
i have set indexes.conf link this:

[qt]
coldToFrozenDir = /SplunkBack/splunk/qt
frozenTimePeriodInSecs = 20736000

20736000 = 240 days

but i can still search last year's data。

splunk enterprise = 6.6.3

thinks

[gcusello · Accepted solution]

Hi liuyongkang,
Splunk stores events in buckets, deletion of old events is managed at bucket level.

In other word a bucket is discarded when the newest bucket event is out of the retention period, this means that surely in the same bucket you have last year events and events in the last 240 days.
This bucket will be discarded when the newest event is over 240 days.

see https://docs.splunk.com/Documentation/Splunk/6.6.3/Indexer/Setaretirementandarchivingpolicy and https://wiki.splunk.com/Deploy:BucketRotationAndRetention

Bye.
Giuseppe

[liuyongkang]

Hi Giuseppe,
think you my friend, let me have a try.