Splunk Enterprise

Timestamps and buckets

PickleRick
SplunkTrust
SplunkTrust

Please confirm something or correct me.

If I understand correctly, it's the event's _time that's the basis for bucket ageing (hot->warm->cold(->frozen)), right?

I understand that it's typically designed this way for collecting event which have monotonicaly "growing" time. But what would happen if my source (regardless of the reason) generated events with a "random" timestamp? One could be from an old past (several years, maybe?), another from the future and so on. Would it mean that I'd have a chance to roll the buckets after just one or two events because I'd have sufficiently old events or sufficiently  big timespan in case of hot buckets?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You are correct that _time is used to put events into buckets.

Events with timestamps outside a specified range are put into "quarantine" buckets.  A quarantine bucket is a separate hot bucket that counts toward the maxHotBuckets limit.  The time range for quarantine is set by quarantinePastSecs and quarantineFutureSecs in indexes.conf.  I imagine it's possible for a quarantine bucket with a single event in it to eventually roll to warm.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You are correct that _time is used to put events into buckets.

Events with timestamps outside a specified range are put into "quarantine" buckets.  A quarantine bucket is a separate hot bucket that counts toward the maxHotBuckets limit.  The time range for quarantine is set by quarantinePastSecs and quarantineFutureSecs in indexes.conf.  I imagine it's possible for a quarantine bucket with a single event in it to eventually roll to warm.

---
If this reply helps you, Karma would be appreciated.

PickleRick
SplunkTrust
SplunkTrust

Ahhh. That's the information lacking in the training 😉

Thanks for supplementing my knowledge 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...