index retirement policies: size versus age

[ualbanytech]

Where index retirement policies are concerned, if you define both size and age I assume first policy type hit wins?

[jbsplunk · Accepted solution]

That is correct, if you hit the size first, it wins. If the data becomes aged beyond what you've specified, that would win.

[ualbanytech]

@gkanapathy, for age, does that imply that deletion may not occur until events go to frozen?

I just found: http://www.splunk.com/base/Documentation/4.1.6/admin/HowSplunkstoresindexes

and skimming it quickly--probably a mistake--it sounds like I could have newer events being added to a bucket which do not exceed my age policy and this would prevent my events from getting deleted.

However it sounds like the situation you mention should only occur in the warm buckets?

[jbsplunk]

Thanks for the clarification.

[gkanapathy]

With the qualification that "age" is not an absolute for each item, but that items older than the specified retirement age may be deleted, as long as all items in the same bucket are also older than the retirement age.