Splunk Enterprise

Timestamps and buckets

PickleRick
Ultra Champion

Please confirm something or correct me.

If I understand correctly, it's the event's _time that's the basis for bucket ageing (hot->warm->cold(->frozen)), right?

I understand that it's typically designed this way for collecting event which have monotonicaly "growing" time. But what would happen if my source (regardless of the reason) generated events with a "random" timestamp? One could be from an old past (several years, maybe?), another from the future and so on. Would it mean that I'd have a chance to roll the buckets after just one or two events because I'd have sufficiently old events or sufficiently  big timespan in case of hot buckets?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You are correct that _time is used to put events into buckets.

Events with timestamps outside a specified range are put into "quarantine" buckets.  A quarantine bucket is a separate hot bucket that counts toward the maxHotBuckets limit.  The time range for quarantine is set by quarantinePastSecs and quarantineFutureSecs in indexes.conf.  I imagine it's possible for a quarantine bucket with a single event in it to eventually roll to warm.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You are correct that _time is used to put events into buckets.

Events with timestamps outside a specified range are put into "quarantine" buckets.  A quarantine bucket is a separate hot bucket that counts toward the maxHotBuckets limit.  The time range for quarantine is set by quarantinePastSecs and quarantineFutureSecs in indexes.conf.  I imagine it's possible for a quarantine bucket with a single event in it to eventually roll to warm.

---
If this reply helps you, an upvote would be appreciated.

PickleRick
Ultra Champion

Ahhh. That's the information lacking in the training 😉

Thanks for supplementing my knowledge 🙂

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...