Both warm and cold buckets are searchable; the differences are location and age. You configure the thresholds in indexes.conf
. See How Splunk stores indexes and Back up indexed data in the documentation for more information.
Both warm and cold buckets are searchable; the differences are location and age. You configure the thresholds in indexes.conf
. See How Splunk stores indexes and Back up indexed data in the documentation for more information.
Accepting this answer, since it more or less answered what I asked. Though, technically the only real difference seems to be location. Splunk rolls warm-to-cold based on age, but there's nothing in the structure of the buckets that would prevent manually moving one to the other, for instance. The real benefit of warm-to-cold would be in the ability to use less-expensive / slower storage for cold buckets which, in theory, would need to be accessed less often.