Hi Splunkers,   While splunking on bucket statistics - I've noticed that despite the fact of default 90 days set for maxHotSpanSecs, I find many buckets (which are not quarantine buckets) with timespan (difference between latest and earliest) around 600 or even 800 days. On the other hand I can also easily find out buckets with timespan of 2 days. Does anyone knows why this could happen ? Is it possible to clearly determine rules  based on which Splunk assigns timespan for hot buckets ?   For checking out my statistics I use below search:   index=_internal component=IndexWriter bucket="hot_*" idx=* | eval bucket_timespan=latest-earliest | eval bucket_timespan=(bucket_timespan/60/60/24) | where bucket_timespan > 90 OR bucket_timespan < 3   ... View more