Why bother with frozen data?
Since frozen buckets require thawing to be accessed, why bother with freezing data?
Is the use case for frozen buckets only to use slower/cheaper media for long-term storage?
If you adjust retention periods, couldn't you accomplish basically the same thing, but without needing to thaw old data, by putting cold buckets on the slower/cheaper storage media?
Submitted April 02, 2020 at 08:41AM
via reddit https://www.reddit.com/r/Splunk/comments/ftlnl4/why_bother_with_frozen_data/?utm_source=ifttt