Hot Bucket Having Old Data

Getting Data In

Hi All,

Just for testing purpose I changed the _internal index storage size as 50MB to see how bucket concept works.

I had last one month of data in hot bucket. Once I changed the size few data where deleted from this month itself.

But a very old data was not deleted. can anyone explain Why it behaves like this?

And the deleted data wasn't moved to Cold Bucket why?

Get Updates on the Splunk Community!

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

A Unified View of Your Data Security logs, application events, business data, and historical telemetry often ...

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner Watch on demand us for a demo-driven ...

Join the Conversation