Hi @thetech thanks for your reply! (I misspelled the title, its is supposed to be "...maxHotSpanSecs of 1day". Sorry about that...) Yes I'm aware of the several ways in which the buckets roll from hot to warm. And that is what's puzzling me... My current config is this. (I have a cluster of 2 Indexers) [my_index]
coldPath = volume:primary/my_index/colddb
homePath = volume:primary/my_index/db
thawedPath = $SPLUNK_DB/my_index/thaweddb
maxHotSpanSecs = 86400
maxHotIdleSecs = 86400 When I run a | dbinspect I get the following results, which indicates that there is one bucket (on each IDX) that still hasn't rolled
... View more