Agreed A, B, C. Quoting the Splunk reference URL https://docs.splunk.com/Documentation/Splunk/8.2.2/Indexer/Bucketsandclusters?
"A hot bucket is a bucket that's still being written to. When an indexer finishes writing to a hot bucket (for example, because the bucket reaches a maximum size), it rolls the bucket to warm and begins writing to a new hot bucket. Warm buckets are readable (for example, for searching) but the indexer does not write new data to them. Eventually, a bucket rolls to cold and then to frozen, at which point it gets archived or deleted.
Searches occur across hot, warm, and cold buckets.
Hot, cold, and warm buckets are all searchable in Splunk, whereas frozen buckets are not searchable.
Hot buckets contain recently indexed data and are actively being written to by the indexer. Warm buckets contain data that has been rolled from hot buckets and is no longer being actively written to, but is still available for search. Cold buckets contain data that has been rolled from warm buckets and is not currently in use, but is still available for search. Frozen buckets contain data that has been rolled from cold buckets and is no longer searchable, but is retained for long-term storage or compliance purposes.
In general, only hot and warm buckets are actively queried during typical Splunk searches. Cold and frozen buckets are used for long-term storage and are generally accessed less frequently.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
newrose
Highly Voted 2 years, 11 months agoucsdmiami2020
2 years agoadamsca
Most Recent 6 months, 2 weeks agokolaturka
6 months, 3 weeks agoApis
1 year, 10 months agomikey_76
2 years, 1 month ago