In Splunk data lifecycle there are several stages the bucket can be in. First the bucket is hot. Splunk is writing new data to it. Then after the bucket meets some parameters (size, age), the "housekeeping" thread closes the bucket and moves it to another directory on the same storage - it's called warm bucket. After the bucket is old enough, if you have separate storage defined for it, the bucked is moved to the cold storage - it's a cold bucket. And finally after the bucket reaches the retention period or the index gets too big, the bucket is frozen - if you have special storage defined for it, the bucket is moved there and removed from splunk (it's meant for archiving and not for direct use anymore). But if you don't have the frozen storage defined (which is the default config), the bucket simply gets deleted. ... View more