some of my data in index "main" shows as 2420 days old, yet my "Frozen Age" is set to 365 days, shouldn't the old data get deleted ?
I am looking at this from the monitoring console, Index Detail: Instance, and the status line has this information:
Data Age vs Frozen Age (days)
2420 / 360
I am using Splunk Entreprise 8.0.5 and my index "main" is defined as so:
[main]
repFactor = auto
coldToFrozenDir = /opt/splunk_buckets/archive/main/frozendb
thawedPath = /opt/splunk_buckets/archive/main/thaweddb
# frozen time is 12 months
frozenTimePeriodInSecs = 31104000
