Why is Splunk keeping data beyond retention period

[Marko]

I'm investigating why Splunk is keeping data beyond retention period stated in frozenTimePeriodInSecs?

How can i fix this?

[deepakc]

Indexed data is set at the bucket (folder) level, Buckets are only frozen deleted or optionally archived when the newest event in the bucket is older than frozenTimePeriodInSecs, therefore you may have a bucket that contains both new and really old data, but the old data won't be frozen until all of the data in the bucket are old (Splunk calculates this in the background)

[Marko]

Thanks @deepakc