Does indexed data traverse through all the buckets before deletion/retention period ?

[splunker12er]

When i set the frozenTimePeriodInSecs value to 1 month, (for eg.) indexed data will start to delete from the start of the next month.
In that case, does indexed data roll from hot to warm, then warm to cold, then cold to frozen?

By default, the maximum size of hot bucket is 750 mb / 90 days before it rolls from Hot to Warm.
Also, the number of Warm databases is 300/ 90 days by default. The older db will start to roll from WARM to Cold database.
By default after 6 years, splunk deletes the data (i.e. frozen)

If this is the case, when my retention period is short, will the data directly be deleted from hot/warm ?

Please advise.

[lguinn2 · Accepted solution]

Yes, when all the events in a bucket are past the retention time, the bucket is frozen or deleted at that point. The bucket could be in warm or cold, it doesn't matter. Just remember that if a bucket has events from multiple days, the bucket can't be frozen until all the data is expired.

BTW, frozen is not the same as deleted. You can ask Splunk to make a copy of a the bucket (excluding the index files) by specifying a frozen path. But if you don't specify a frozen path (or a script for freezing the data), then Splunk simply deletes the expired bucket.