Getting Data In

What timestamp is used to count the seconds to satisfy the frozen bucket time?

ankithreddy777
Contributor

On what time basis Splunk data moves to frozen after it satisfied frozenTimePeriosdinSecs.

Index Time of event OR Timestamp of the event ?

Because I have seen events still not deleted who's timestamp is older than given frozenTimePeriosdinSecs time.

0 Karma

hgrow
Communicator

hi there,

without answering your question .. splunk does not rotate per event but per bucket. so it can happen that very old AND new events get mixed together in one bucket and this specific bucket is only allowed ro rotate if all events matches your frozenTime-parameter so your bucket with old and new data is basicly not allowed to rotate. this can happen if your sourcetypes time extraction is off or you just get weird data indexed somehow or many many more reasons.

There is a field called _bkt. you can check the time period for that specific bucket that holds older events than your frozentimeperiod.
greetings

0 Karma

hgrow
Communicator
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Splunk does data retention based on timestamp of event (_time). The retention period that you specify in frozenTimePeriosdinSecs is basically the "minimum retention" that you'll see for your data, not the cutoff. The reason for this is that data retention is done for the buckets, not individual events. The data is stored in buckets where a bucket can have data for varied range of timestamp. A bucket (cold) is only frozen if all it's events are older than retention period, so even though a bucket contains some data older than frozenTimePeriodInSecs, there may be some which are not and thus the bucket stays.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...