Why am I still seeing data older than my frozenTimePeriodInSecs retention setting?

[neelamsantosh]

I have set the values to
maxDataSize = 1024
maxHotIdleSecs = 86400
maxWarmDBCount = 30
frozenTimePeriodInSecs = 6480000

But still i am seeing the older than 6480000 (75days) logs.

[somesoni2]

A bucket will only be frozen if the youngest/earliest event in the bucket exceeds time period set on frozenTimePeriodInSecs. So there could be buckets with most of their events past 75days but not all so it will still be in the cold db (searchable).

[ryanoconnor]

It's possible some data in a bucket isn't older than 75 days. All data in a Data Bucket must be older than the frozenTimePeriodInSecs before it will roll.

Source: http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Indexesconf