Hi,
I was looking for the retention period for my index main and _internal and noticed the data is outide our default frozenTimePeriodInSecs. Standard this is 555 days.
I went searching for the buckets which are outside the normal time with the searches from this answer:
https://community.splunk.com/t5/Getting-Data-In/bucket-retention-and-frozenTimePeriodInSecs/m-p/1163...
and to my surprise.. the buckets are al hot.. and way old. What bothers me are those buckets are all in folder called hot_quar_v1_xxxx and the normal folders starting with previous xxxxx from the quar folder.
What to do with this data? I want to reduce the frozenTimePeriodInSecs from 555 days to say 30 days.. but it doesn't seems to work this way if there are buckets as old as 100961834 secs in those hot_quar folders.
Is there a way to clean those folders and set the frozenTimePeriodInSecs?
thanx in advance
Jari
