I've read all the articles and past questions but I must be missing something. Our requirement is simple 6 months searchable, 6 months frozen. then delete. but seems there is not an easy setting for anything less than cold to say 6months before roll. just seems data sizes?  currently our hot/warm/cold disk space is full and frozen is empty [ns-switches] homePath = volume:primary/ns-switches/db coldPath = volume:primary/ns-switches/colddb thawedPath = $SPLUNK_DB/ns-switches/thaweddb maxTotalDataSizeMB = 512000 maxDataSize = auto_high_volume coldToFrozenDir = /splunkfrozen/idx1/ns-switches/frozendb frozenTimePeriodInSecs = 4320000 ... View more