When will my buckets roll?

[erw550]

Hello,

We have a clustered environment which collects 2000gb+/day with indexes.conf settings below and the rest of the settings is default.
When does the frozenTimePeriodInSecs starts its count? Is it when the data is in the hot, warm or cold buckets?
When will the buckets roll from hot to warm, and from warm to frozen in my case? Is it after 90 days since MaxHotSpanSecs default is 90 days?
What is the approximate retention time for data with this config?
And the maxWarmDBCount = 4294967295 seems really high in this case. See config below:

[index_name]

homePath = volume:hot_warm/index_name/main/db

coldPath = volume:cold/index_name/main/colddb

thawedPath = /opt/splunk/indexes/index_name/main/thaweddb

maxWarmDBCount = 4294967295

frozenTimePeriodInSecs = 31104000

maxDataSize = auto_high_volume

maxTotalDataSizeMB = 4294967295

repFactor = auto

Thanks in advance!

[isoutamo]

Hi

In practically thinking you can count that it starts when hot bucket rolls to warm. It count the time from event's time not indexing time. Basically this means that this time can fulfil already when hot -> warm rolling has happened. But as all buckets has several event splunk will look the newest event (based on event creation time/_time) this is not that simple. Splunk must wait until all events has older than frozenTimePeriodInSecs before it get rid of that bucket. For that reason it's normal situation that there are some older events in splunk than you are expecting.

As you already notice there are also other parameters which define when the bucket actually will be frozen. Usually this means that lowest value of those will define that time.

There is something more:

• https://docs.splunk.com/Documentation/Splunk/8.2.4/Indexer/Setaretirementandarchivingpolicy
• https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-...

You could also search more information from community.

r. Ismo