Hot Bucket Having Old Data

Getting Data In

Hi All,

Just for testing purpose I changed the _internal index storage size as 50MB to see how bucket concept works.

I had last one month of data in hot bucket. Once I changed the size few data where deleted from this month itself.

But a very old data was not deleted. can anyone explain Why it behaves like this?

And the deleted data wasn't moved to Cold Bucket why?

Get Updates on the Splunk Community!

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Join the Conversation