which of the following initiates data rotation between buckets.
Is it the time from which the event is indexed or is it the timestamp attached to the event?
Hi James, neither of them if you talk about hot/warm buckets. Those are created and rotated solely based on the size and number of those already in these statuses.
Some more settings may be applied, please check the Index.conf docs for that.