What are the criteria for a warm bucket to be moved to cold?

[danielbb]

We see cases where warm buckets are not being moved to cold storage for six weeks, and we wonder how to set it up correctly so they move within two or three weeks.

[richgalloway]

There is no time constraint for warm buckets.  Warm buckets roll to cold when there are too many of them (maxWarmDBCount) or there's too much data in the warm volume (homePath.maxDataSizeMB or maxVolumeDataSizeMB).

See https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Configureindexstorage for more information.