Calculate Bucket Thaw Time

Splunk Search

Hey All,

Was just curious if there is a way to calculate how long it should take to thaw\rebuild frozen buckets for searching?

We recently started a thaw of a month's worth of data of Windows events that is taking a considerable amount of time. Going on 5 hours now across 3 clustered IDX's. We have 6 total IDX's clustered and we perform the thaw\rebuild on 3 at a time to ensure we can balance data ingestion and the thaw process.

I would love to be able to set expectations when other business units ask for historical data to be loaded, on how long it will take to be ready.

I'm sure it depends on CPU\HDD speed\bucket size but was curious if anyone has a way to determine some rough calculations.

Thanks!

Andrew

Get Updates on the Splunk Community!

Calculate Bucket Thaw Time

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Calculate Bucket Thaw Time

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future