Old Data in Hot Buckets

[phanichintha]

Hello,

In my indexer i have old data in hot buckets why can any once help me I don't want this old data in hot buckets.

[richgalloway]

I'll assume you've restarted Splunk since 2017. Since a restart would have rolled those buckets to warm, I would say you're ingesting data with old timestamps.

[phanichintha]

Hello Rich, Thanks for your swift response.

I restart the indexer twice in a month, so i need a solution that old data can move to warm buckets. I don't need any old data in hot buckets. I need day-wise(latest) data only in hot buckets. what should i do now? 

[richgalloway · Accepted solution]

If you restart the indexer twice a month then there should be no hot buckets more than 2 weeks old.  In theory, all hot buckets would have timestamps in the last two weeks, but sometimes data arrives with old/bad timestamps.  When that happens, a new hot bucket will be created for that old data.  I suspect this is what you are seeing, but it's a little hard to grok the Excel spreadsheet in your screen shot.

[phanichintha]

Thank you, Rich,

After i restarted the Indexer the changes happen.