How hot bucket timespan is set ?

Deployment Architecture

Hi Splunkers,

While splunking on bucket statistics - I've noticed that despite the fact of default 90 days set for maxHotSpanSecs, I find many buckets (which are not quarantine buckets) with timespan (difference between latest and earliest) around 600 or even 800 days. On the other hand I can also easily find out buckets with timespan of 2 days. Does anyone knows why this could happen ?

Is it possible to clearly determine rules based on which Splunk assigns timespan for hot buckets ?

For checking out my statistics I use below search:

index=_internal component=IndexWriter bucket="hot_*" idx=* 
| eval bucket_timespan=latest-earliest 
| eval bucket_timespan=(bucket_timespan/60/60/24) 
| where bucket_timespan > 90 OR bucket_timespan < 3