Thanks @PickleRick  your last reply showed me what i was looking for. Data now rolls of after it get's to cold. Not able to search when it gets to cold. ... View more

Yes.... It's showing maximum warm bucket exceeded. Firing async chiller ... View more

Here's my configuration [mack] repFactor=auto coldPath = volume:cold/customer/mack/colddb homePath = volume:hot_warm/customer/mack/db thawedPath = /splunk/data/cold/customer/mack/thaweddb frozenTimePeriodInSecs = 34186680 maxHotBuckets = 10 maxTotalDataSizeMB = 400000 so instead of data rolling to cold, it rolls off ... View more