Getting Data In

Index freezing - event or bucket timestamp

MHibbin
Influencer

Hi there,

Quick one, does Splunk freeze data based on bucket timestamp or event timestamp?

Cheers,

MHibbin

0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

Event. The oldest bucket where the latestTime is completely outside of the time window. If freezing based on size, the oldest bucket by latestTime, regardless of whether it's outside the time window. I've seen (small) indexes roll from hot to warm and then immediately freeze!

View solution in original post

sowings
Splunk Employee
Splunk Employee

Event. The oldest bucket where the latestTime is completely outside of the time window. If freezing based on size, the oldest bucket by latestTime, regardless of whether it's outside the time window. I've seen (small) indexes roll from hot to warm and then immediately freeze!

reedmohn
Communicator

I though it was index time(?)

That's not necessarily the same as event time, for instance if you add a new forwarder, but it collects logs with events from far back in time.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...