I've been asked to size a Splunk installation with only 30 days of hot/warm data - no cold data. I've never heard of this before. I could probably set
coldPath=/dev/null so warm data is deleted instead of being moved to cold, but can Splunk handle that?
If this reply helps you, Karma would be appreciated.