Getting Data In

Why does Splunk seem to have more than 90 days of data with our frozenTimePeriodInSecs setting?

ddrillic
Ultra Champion

We changed frozenTimePeriodInSecs = 10368000 (120 days from 90 days) for the layer7 index 30 days ago.

It shows the following:

alt text

However, when it reached the the three months break of 2/23, it showed 1,401,173,823 of 1,401,173,823 events matched, but no events kept showing up. We ended up with 2.1 billion events processed. So, it seems as though Splunk has more than 90 days of data, but it stops showing events at the 90 days break.

On the indexer, under the cold bucket, the oldest directory is of 2/23.

What can it be?

0 Karma

ddrillic
Ultra Champion

Thank you for the help - we "simply" ran out of space for this specific index of 500 GBs. it coincided with the 90 days period which threw us off.

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

You didn't show the time period you picked for your search. If it was last 90 days then it would only show events for that range.

As far as the frozenTimePeriodInSecs setting, a bucket will only be frozen if the youngest event in the bucket exceeds that time period. So there could be buckets with most of their events past 90 days but not all so it will still be in the cold db.

0 Karma

ddrillic
Ultra Champion

Any thoughts, by any chance, on this one?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...