We've been having the same problem. We've tested several scenarios and in every case, regardless of the event time stamp (future, past, present) if TSIDX reduction is enabled on the index it immediately goes into effect when a bucket migrates from hot to warm. This applies to 6.6.0 and 6.6.1. We also experimented with setting a timezone in the past just to see if it made a difference and it didn't. So it would seem if you're using this feature with on-prem Splunk 6.6.0 or newer you're probably wondering why searches seem significantly slower than prior to the update.
... View more