Getting Data In

What timestamp is used to count the seconds to satisfy the frozen bucket time?


On what time basis Splunk data moves to frozen after it satisfied frozenTimePeriosdinSecs.

Index Time of event OR Timestamp of the event ?

Because I have seen events still not deleted who's timestamp is older than given frozenTimePeriosdinSecs time.

0 Karma


hi there,

without answering your question .. splunk does not rotate per event but per bucket. so it can happen that very old AND new events get mixed together in one bucket and this specific bucket is only allowed ro rotate if all events matches your frozenTime-parameter so your bucket with old and new data is basicly not allowed to rotate. this can happen if your sourcetypes time extraction is off or you just get weird data indexed somehow or many many more reasons.

There is a field called _bkt. you can check the time period for that specific bucket that holds older events than your frozentimeperiod.

0 Karma

0 Karma

Revered Legend

Splunk does data retention based on timestamp of event (_time). The retention period that you specify in frozenTimePeriosdinSecs is basically the "minimum retention" that you'll see for your data, not the cutoff. The reason for this is that data retention is done for the buckets, not individual events. The data is stored in buckets where a bucket can have data for varied range of timestamp. A bucket (cold) is only frozen if all it's events are older than retention period, so even though a bucket contains some data older than frozenTimePeriodInSecs, there may be some which are not and thus the bucket stays.

Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...