Calculate Bucket Thaw Time

Splunk Search

Hey All,

Was just curious if there is a way to calculate how long it should take to thaw\rebuild frozen buckets for searching?

We recently started a thaw of a month's worth of data of Windows events that is taking a considerable amount of time. Going on 5 hours now across 3 clustered IDX's. We have 6 total IDX's clustered and we perform the thaw\rebuild on 3 at a time to ensure we can balance data ingestion and the thaw process.

I would love to be able to set expectations when other business units ask for historical data to be loaded, on how long it will take to be ready.

I'm sure it depends on CPU\HDD speed\bucket size but was curious if anyone has a way to determine some rough calculations.

Thanks!

Andrew

Get Updates on the Splunk Community!

Calculate Bucket Thaw Time

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation

Calculate Bucket Thaw Time

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas