@DalJeanis Thanks for the encouragement. I thnk I just feel a tad bit overwhelemed with a lot of this, as the whole hot/warm/cold/thawed buckets are slightly foreign.
So from the Wiki LInk: http://wiki.splunk.com/Deploy:BucketRotationAndRetention
I have been able to see most of the variables and settings that I need to set to configure the movements from hot to warm to cold. But I have a couple of questions yet. Once an object is in the "frozen" bucket. What setting drives how long it stays frozen. For instance, if I only want to keep data in Frozen for 6 months and then its deleted.
Also, if I ever decide to rebuild the data and move it from Frozen to thawed, what happens to the thawed data. Does it stay in the thawed bucket indefinitely? Or is it reintroduced back to frozen after a certain amount of time?
Again I apologize if these are relatively noob-like question, I just feel like I have been throw into the deep end here. Thanks again for all of your amazing help.
... View more