Hot Bucket Having Old Data

Getting Data In

Hi All,

Just for testing purpose I changed the _internal index storage size as 50MB to see how bucket concept works.

I had last one month of data in hot bucket. Once I changed the size few data where deleted from this month itself.

But a very old data was not deleted. can anyone explain Why it behaves like this?

And the deleted data wasn't moved to Cold Bucket why?

Get Updates on the Splunk Community!

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Join the Conversation