Ok I see what you're saying -- "The first epoch time is the earliest event in the bucket, and the second epoch time is the earliest event in a bucket"
(I assume you actually mean - the second epoch time is the latest event in a bucket)
I still can't see how it's not working 'as designed'. The largest warm bucket spans Oct22'11 to Jan19'12 and many other buckets have been moved to cold while that one sits in warm. See also all the buckets dated ca Dec 22 (with epoch times to match) that are sitting there.
I'm going to down splunk and move these manually later today.
... View more