I am looking to completely remove data from an Index after 30 days. Looking into utilizing "frozentimeperiodinsecs" to set the threshold but from what I've looked into this applies to an entire bucket. Just need some confirmation in my understanding before moving forward:
- Does "frozentimeperiodinsecs" only apply to warm or cold buckets? If I were to set this without configuring warm or cold buckets would it not touch the hot bucket due to Splunk not allowing it to pull directly from there?
- If so am I correct to assume that I also need to set "maxHotSpanSecs" AND "maxDataSize" parameters slightly before (like a day) so "frozentimeperiodinsecs" can then pull from the warm bucket to delete?
So let me us an analogy to make sure I understand using Splunk's terms:
As data is coming in it's "pouring" into a hot bucket. Once "maxHotSpanSecs" threshold is met it moves that bucket to warm and I'm assuming it creates a new hot bucket for the newer data pouring in. Once the bucket goes to warm "frozenTimePeriodInSec" kicks in and starts to count down in seconds based off of it's set value. When that is met the entire bucket is deleted.