Hey @jackiewkc, Here's a link to an overview: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Bucketsandclusters
Buckets can be configured for max size or time and they rotate when the last event to enter the bucket matches the criteria. Hot/warm are stored in a different location than cold, which helps w/ search efficiency. (Splunk skips buckets if it can tell from the outside that the time range won't match, which is part of why time is such an efficient search parameter). For it to roll into colddb the conditions are configurable (for all stages, that is). You can read more about those configurations here: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Configureindexstorage
... View more