Hi @felipesodre , when your bucket completely exceed the retention time (also the earliest event in the bucket) or the bucket reaches the maxSize it can be discarded or moved to offline in a different folder. As described at https://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Indexesconf , it dependa on the parameter coldToFrozenScript that specifies a script to run when data is to leave the splunk index system, in other words, what happens to the bucket after the retention period. If, using a script, you move your Cold Bucket to offline, you can re use them copying them in the Thawed path. Otherwise you can discard them and the entire bucket is deleted. You can find more details in this document https://docs.splunk.com/Documentation/Splunk/9.1.1/Indexer/Setaretirementandarchivingpolicy  Ciao. Giuseppe ... View more

Hi @PavelP, I believe that the Splunk app menu configuration page is indecent, for this purpose I made a request on Splunk Ideas that please vote for the idea https://ideas.splunk.com/ideas/EID-I -72 .  In any case, the only way to do it could be a phyton script, but there would always be the problem of rights: do all users have the right to modify the menu of an app? For these reasons, I am sorry, but I believe that your request cannot be satisfied. Ciao. Giuseppe ... View more