Why is my bucket not rolling to frozen?

[patouellet]

Hi,

I have an index that I recently reconfigured with frozenTimePeriodInSecs=94867200, so I shouldn't have events older than about 3 years.

But when looking at the monitoring console, under Index detail, I see

Data Age vs Frozen Age (days): 1587 / 1098
Earliest Event: 2013-11-29

I was under the impression that frozenTimePeriodInSecs would role buckets from cold to frozen, effectively deleting them, but apparently it's not.

What am I missing here?

Thank you

[richgalloway · Accepted solution]

Buckets won't roll until the newest event is older than frozenTimePeriodInSecs. Depending on the activity in that index, a bucket may have some events that are very old and others that are not old enough to roll.

[patouellet]

Thanks. Any way I can verify that by querying individual buckets - finding out the most recent event of my oldest bucket?

[richgalloway]

Run a search to find an event in an old bucket and add | eval bktId=_bkt on the end. Then search | dbinspect index=foo | where bucketId="<bktId>" | convert ctime(startEpoch) | convert ctime(endEpoch) to see the start and end dates for that bucket.

[patouellet]

Awesome. This revealed that the most recent event in a bucket I thought was pretty old is Jan 1st 2016, which is less than the 3 years I setup in indexes.conf. You rock.