According to the "Set a retirement and archiving policy" and "indexes.conf" documentation on splunk docs, the settings i've configured should roll the buckets to my frozen directory when the events are two weeks old and leave them there for me to handle.
However - myself and the sales engineer are stumped as to why the events in the hot bucket are still over 3 months old. Have we read the documentation correctly? Your input is greatly appreciated.
Thanks for your reply Rich. Looks like this worked and it is now rolling the data to my frozen bucket. I have also set frozentimeperiodinsecs = 1209600 but yet the data in my hot/warm bucket is still aged as far back as 7 months and I don't have any data being rolled into the cold buckets. Any idea why this would be happening?