Hot Bucket Having Old Data

Getting Data In

Hi All,

Just for testing purpose I changed the _internal index storage size as 50MB to see how bucket concept works.

I had last one month of data in hot bucket. Once I changed the size few data where deleted from this month itself.

But a very old data was not deleted. can anyone explain Why it behaves like this?

And the deleted data wasn't moved to Cold Bucket why?

Get Updates on the Splunk Community!

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Join the Conversation