Yep. I changed the way I think of the bucket life cycle with SmartStore. Hot is read/write and replicated just like non-SmartStore. Once they roll to read only, they aren't "warm" or "cold" to me anymore, they are just read only as they are copied to the remote object store. Once a bucket exists on the remote object store, we only download bits and pieces, not necessarily the whole bucket, when it is time to search it. Once in the remote object store, there are no warm, cold, or thawed boundaries anymore. Freezing of buckets still exists, which deletes them (by default). ... View more

1) Nope, I did my testing for this on an SmartStore enabled stack. 2) The bucket limits are Splunk version dependent. The 5m bucket limit I'm aware of is from 6.6 -> 7.1 and it's 5M unique buckets, 15M total buckets (with default RF=3). So both values may apply. ... View more