How to Move manually buckets from hot to cold

[ajromero]

we set the buckets to roll from hot into cold for 90 days, but for some reason is not doing it and we are running low on space. How can I manually move buckets from to cold to free space

Thank you

[richgalloway · Accepted solution]

Buckets normally move from hot to warm to cold rather than from hot directly to cold.

The default lifespan for a hot bucket is 90 days, after which it should roll to warm.  This can be changed with the maxHotSpanSecs attribute in indexes.conf.  You can also force a roll using REST or by restarting the indexer(s).

For a list of other attributes that affect index retention at each level, see https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Configureindexstorage