Thanks for you Feedback. I think the ksconf App might be the right Solution for my UseCase. ... View more

As an addition to what @livehybrid already said, see the .conf presentation https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf frozenTimePeriodInSecs only affects cold buckets. So a bucket has to first reach this stage in its life cycle. And hot buckets are rolled on a completely different basis than time-based retention limit. That's it. That's also why the usual questions like "how to make sure we have 2 days of hot buckets, a week of warm buckets and two months of cold buckets" get the response of "you can't do it this way". ... View more

It can be done (half of ES works this way) but it's ugly. An input is what should work as... well, an input. Not as a vessel to run something that does something completely different. So you have two options (apart from ingesting data into an index) - run a completely external tool - for example with cron - which will fiddle with splunk by API or indeed run a modular input. Both solutions are not very pretty. ... View more