Getting Data In

What timestamp is used to count the seconds to satisfy the frozen bucket time?


On what time basis Splunk data moves to frozen after it satisfied frozenTimePeriosdinSecs.

Index Time of event OR Timestamp of the event ?

Because I have seen events still not deleted who's timestamp is older than given frozenTimePeriosdinSecs time.

0 Karma


hi there,

without answering your question .. splunk does not rotate per event but per bucket. so it can happen that very old AND new events get mixed together in one bucket and this specific bucket is only allowed ro rotate if all events matches your frozenTime-parameter so your bucket with old and new data is basicly not allowed to rotate. this can happen if your sourcetypes time extraction is off or you just get weird data indexed somehow or many many more reasons.

There is a field called _bkt. you can check the time period for that specific bucket that holds older events than your frozentimeperiod.

0 Karma

0 Karma

Revered Legend

Splunk does data retention based on timestamp of event (_time). The retention period that you specify in frozenTimePeriosdinSecs is basically the "minimum retention" that you'll see for your data, not the cutoff. The reason for this is that data retention is done for the buckets, not individual events. The data is stored in buckets where a bucket can have data for varied range of timestamp. A bucket (cold) is only frozen if all it's events are older than retention period, so even though a bucket contains some data older than frozenTimePeriodInSecs, there may be some which are not and thus the bucket stays.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...