Splunk going down in events indexed

[nkitmitto]

All day, I've been watching the amount of events indexed in Splunk go up and down. It stays in the 1.8-1.9 billion events range, but it's going up and down. Saw it at 1.96 billion today, and then it went down to 1.93 back to 1.96 and now 1.89. Is there a default setting somewhere I need to look at?

[dwaddle]

Check out settings in indexes.conf. As buckets roll from cold to frozen, they will be removed from the index and the indexed event count will go down by the number of events in the bucket.

Good docs reference @ http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/Setaretirementandarchivingpolicy