Getting Data In

Why does Splunk seem to have more than 90 days of data with our frozenTimePeriodInSecs setting?

ddrillic
Ultra Champion

We changed frozenTimePeriodInSecs = 10368000 (120 days from 90 days) for the layer7 index 30 days ago.

It shows the following:

alt text

However, when it reached the the three months break of 2/23, it showed 1,401,173,823 of 1,401,173,823 events matched, but no events kept showing up. We ended up with 2.1 billion events processed. So, it seems as though Splunk has more than 90 days of data, but it stops showing events at the 90 days break.

On the indexer, under the cold bucket, the oldest directory is of 2/23.

What can it be?

0 Karma

ddrillic
Ultra Champion

Thank you for the help - we "simply" ran out of space for this specific index of 500 GBs. it coincided with the 90 days period which threw us off.

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

You didn't show the time period you picked for your search. If it was last 90 days then it would only show events for that range.

As far as the frozenTimePeriodInSecs setting, a bucket will only be frozen if the youngest event in the bucket exceeds that time period. So there could be buckets with most of their events past 90 days but not all so it will still be in the cold db.

0 Karma

ddrillic
Ultra Champion

Any thoughts, by any chance, on this one?

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...