Deployment Architecture

What initiates the data rotation between buckets?

Path Finder

Hi all,

which of the following initiates data rotation between buckets.

Is it the time from which the event is indexed or is it the timestamp attached to the event?


Tags (2)
0 Karma


Hi James, neither of them if you talk about hot/warm buckets. Those are created and rotated solely based on the size and number of those already in these statuses.

  • Older hot buckets are rolled to warm when they are more than maxHotBuckets, each as big as maxDataSize specifies (plus some other idle data rules...).
  • Older warm buckets are rolled to cold when they are more than maxWarmDBCount.
  • Older cold buckets are rolled to frozen when their latest event timestamp is older than frozenTimePeriodInSecs.
  • Also, if the index grows more than maxTotalDataSizeMB, the oldest data is rolled to frozen.

Some more settings may be applied, please check the Index.conf docs for that.


0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...