All,
When does Splunk look at the time on a piece of data and determine the data is aged beyond the index retention and dump said data? Is this a nightly job, real time? How can I view this process and kick it off manually if needed?
