Hot Bucket Having Old Data

Getting Data In

Hi All,

Just for testing purpose I changed the _internal index storage size as 50MB to see how bucket concept works.

I had last one month of data in hot bucket. Once I changed the size few data where deleted from this month itself.

But a very old data was not deleted. can anyone explain Why it behaves like this?

And the deleted data wasn't moved to Cold Bucket why?

Get Updates on the Splunk Community!

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl. To make life better, use an ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...

Join the Conversation