events time stamp is older than the index retention period ,how can we fix this.

[rajneeshc1981]

events time stamp is older than the index retention period ,how can we fix this. ..please let me know.

[diogofgm]

A event only rolls over the retention period when all data in his bucket rolls over the retention period.
Check the volume of data you're indexing daily and the size of you buckets. By default a bucket is 750MB of size so if you indexing alot less than that daily, it might take some days to your bucket to roll.

try this to check the dates in your buckets

index=your_index
| eval bkt = _bkt 
| stats count min(_time) as min_time max(_time) as max_time by bkt | sort bkt
| convert ctime(*_time)

[rajneeshc1981]

how do I fix I see some events are older few days than indexed retention.

[diogofgm]

You reduce the size of your buckets close to what you are indexing daily using the maxDataSize parameter in your index stanza in indexes.conf
Check the docs here:
https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Indexesconf

[rajneeshc1981]

how to fix _time issues its not matching with index time for the events.
_time shows 2015 and index time shows current time.

[somesoni2]

The _time is epoch representation of the timestamp found in raw data. The _indextime is when the event got index. If _time is extracted/evaluated from raw data, both will almost never be same (there will be at least some delay if _time is in past). If you want your _time to be same as _indextime you'd need to set your timestamp recognition to use current time. See this and read about DATETIME_CONFIG attribute that you can set for your sourcetype:
http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Configuretimestamprecognition#Timestamp_attri...

[rajneeshc1981]

what is there is an issue with timestamp recognition or truncating ,how will I fix those type ?.